<!DOCTYPE HTML>
<html lang="zh-CN">


<head>
    <meta charset="utf-8">
    <meta name="keywords" content="Ubuntu22.04-headscale部署, 搞机の基地">
    <meta name="description" content="Tailscale 是一种基于 WireGuard 的虚拟组网工具，和 Netmaker 类似，最大的区别在于 Tailscale 是在用户态实现了 WireGuard 协议，而 Netmaker 直接使用了内核态的 WireGuard。所以 Tailscale 相比于内核态 WireGuard 性能会有所损失，但与 OpenVPN 之流相比还是能甩好几十条街的，Tailscale 虽然在性能上做了些许取舍，但在功能和易用性上绝对是完爆其他工具.">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
    <meta name="renderer" content="webkit|ie-stand|ie-comp">
    <meta name="mobile-web-app-capable" content="yes">
    <meta name="format-detection" content="telephone=no">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <meta name="referrer" content="no-referrer-when-downgrade">
    <!-- Global site tag (gtag.js) - Google Analytics -->


    <title>Ubuntu22.04-headscale部署 | 搞机の基地</title>
    <link rel="icon" type="image/png" href="/favicon.png">
    


    <!-- bg-cover style     -->



<link rel="stylesheet" type="text/css" href="/libs/awesome/css/all.min.css">
<link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
<link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
<link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
<link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
<link rel="stylesheet" type="text/css" href="/css/matery.css">
<link rel="stylesheet" type="text/css" href="/css/my.css">
<link rel="stylesheet" type="text/css" href="/css/dark.css" media="none" onload="if(media!='all')media='all'">




    <link rel="stylesheet" href="/libs/tocbot/tocbot.css">
    <link rel="stylesheet" href="/css/post.css">




    
        <link rel="stylesheet" type="text/css" href="/css/reward.css">
    



    <script src="/libs/jquery/jquery-3.6.0.min.js"></script>

<meta name="generator" content="Hexo 6.3.0"></head>


<body>
    <header class="navbar-fixed">
    <nav id="headNav" class="bg-color nav-transparent">
        <div id="navContainer" class="nav-wrapper container">
            <div class="brand-logo">
                <a href="/" class="waves-effect waves-light">
                    
                    <img src="/medias/logo.png" class="logo-img" alt="LOGO">
                    
                    <span class="logo-span">搞机の基地</span>
                </a>
            </div>
            

<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
<ul class="right nav-menu">
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/" class="waves-effect waves-light">
      
      <i class="fas fa-home" style="zoom: 0.6;"></i>
      
      <span>首页</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="" class="waves-effect waves-light">

      
      <i class="fas fa-project-diagram"" style="zoom: 0.6;"></i>
      
      <span>项目</span>
      <i class="fas fa-chevron-down" aria-hidden="true" style="zoom: 0.6;"></i>
    </a>
    <ul class="sub-nav menus_item_child ">
      
      <li>
        <a target="_blank" rel="noopener" href="https://github.com/liangyoufeng/devpos">
          
          <span>devops</span>
        </a>
      </li>
      
    </ul>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/tags" class="waves-effect waves-light">
      
      <i class="fas fa-tags" style="zoom: 0.6;"></i>
      
      <span>标签</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/categories" class="waves-effect waves-light">
      
      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
      
      <span>分类</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/archives" class="waves-effect waves-light">
      
      <i class="fas fa-archive" style="zoom: 0.6;"></i>
      
      <span>归档</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/about" class="waves-effect waves-light">
      
      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
      
      <span>关于</span>
    </a>
    
  </li>
  
  <li>
    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
    </a>
  </li>
  <li>
    <a href="javascript:;" class="waves-effect waves-light" onclick="switchNightMode()" title="深色/浅色模式" >
      <i id="sum-moon-icon" class="fas fa-sun" style="zoom: 0.85;"></i>
    </a>
  </li>
</ul>


<div id="mobile-nav" class="side-nav sidenav">

    <div class="mobile-head bg-color">
        
        <img src="/medias/logo.png" class="logo-img circle responsive-img">
        
        <div class="logo-name">搞机の基地</div>
        <div class="logo-desc">
            
            用来测试知识库
            
        </div>
    </div>

    <ul class="menu-list mobile-menu-list">
        
        <li class="m-nav-item">
	  
		<a href="/" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-home"></i>
			
			首页
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="javascript:;">
			
				<i class="fa-fw fas fa-project-diagram""></i>
			
			项目
			<span class="m-icon"><i class="fas fa-chevron-right"></i></span>
		</a>
            <ul  style="background:  ;" >
              
                <li>

                  <a target="_blank" rel="noopener" href="https://github.com/liangyoufeng/devpos " style="margin-left:75px">
				  
		          <span>devops</span>
                  </a>
                </li>
              
            </ul>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/tags" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-tags"></i>
			
			标签
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/categories" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-bookmark"></i>
			
			分类
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/archives" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-archive"></i>
			
			归档
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/about" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-user-circle"></i>
			
			关于
		</a>
          
        </li>
        
        
        <li><div class="divider"></div></li>
        <li>
            <a href="https://github.com/blinkfox/hexo-theme-matery" class="waves-effect waves-light" target="_blank">
                <i class="fab fa-github-square fa-fw"></i>Fork Me
            </a>
        </li>
        
    </ul>
</div>


        </div>

        
            <style>
    .nav-transparent .github-corner {
        display: none !important;
    }

    .github-corner {
        position: absolute;
        z-index: 10;
        top: 0;
        right: 0;
        border: 0;
        transform: scale(1.1);
    }

    .github-corner svg {
        color: #0f9d58;
        fill: #fff;
        height: 64px;
        width: 64px;
    }

    .github-corner:hover .octo-arm {
        animation: a 0.56s ease-in-out;
    }

    .github-corner .octo-arm {
        animation: none;
    }

    @keyframes a {
        0%,
        to {
            transform: rotate(0);
        }
        20%,
        60% {
            transform: rotate(-25deg);
        }
        40%,
        80% {
            transform: rotate(10deg);
        }
    }
</style>

<a href="https://github.com/blinkfox/hexo-theme-matery" class="github-corner tooltipped hide-on-med-and-down" target="_blank"
   data-tooltip="Fork Me" data-position="left" data-delay="50">
    <svg viewBox="0 0 250 250" aria-hidden="true">
        <path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path>
        <path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2"
              fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path>
        <path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z"
              fill="currentColor" class="octo-body"></path>
    </svg>
</a>
        
    </nav>

</header>

    



<div class="bg-cover pd-header post-cover" style="background-image: url('/images/Ubuntu22-04-headscale%E9%83%A8%E7%BD%B2/top4.jpg')">
    <div class="container" style="right: 0px;left: 0px;">
        <div class="row">
            <div class="col s12 m12 l12">
                <div class="brand">
                    <h1 class="description center-align post-title">Ubuntu22.04-headscale部署</h1>
                </div>
            </div>
        </div>
    </div>
</div>




<main class="post-container content">

    
    <div class="row">
    <div id="main-content" class="col s12 m12 l9">
        <!-- 文章内容详情 -->
<div id="artDetail">
    <div class="card">
        <div class="card-content article-info">
            <div class="row tag-cate">
                <div class="col s7">
                    
                    <div class="article-tag">
                        
                            <a href="/tags/VPN/">
                                <span class="chip bg-color">VPN</span>
                            </a>
                        
                            <a href="/tags/wireguard/">
                                <span class="chip bg-color">wireguard</span>
                            </a>
                        
                            <a href="/tags/headscale/">
                                <span class="chip bg-color">headscale</span>
                            </a>
                        
                    </div>
                    
                </div>
                <div class="col s5 right-align">
                    
                    <div class="post-cate">
                        <i class="fas fa-bookmark fa-fw icon-category"></i>
                        
                            <a href="/categories/VPN%E6%8A%98%E8%85%BE%E5%90%88%E9%9B%86/" class="post-category">
                                VPN折腾合集
                            </a>
                        
                    </div>
                    
                </div>
            </div>

            <div class="post-info">
                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
                    2023-08-17
                </div>
                

                

                

                

                
            </div>
        </div>
        <hr class="clearfix">

        
        <!-- 是否加载使用自带的 prismjs. -->
        <link rel="stylesheet" href="/libs/prism/prism.min.css">
        

        

        <div class="card-content article-card-content">
            <div id="articleContent">
                <p>Headscale 是什么<br>Tailscale 的控制服务器是不开源的，而且对免费用户有诸多限制，这是人家的摇钱树，可以理解。好在目前有一款开源的实现叫 Headscale，这也是唯一的一款，希望能发展壮大。</p>
<p>Headscale 由欧洲航天局的 Juan Font 使用 Go 语言开发，在 BSD 许可下发布，实现了 Tailscale 控制服务器的所有主要功能，可以部署在企业内部，没有任何设备数量的限制，且所有的网络流量都由自己控制。</p>
<p>目前 Headscale 还没有可视化界面，期待后续更新吧。</p>
<h3 id="1、创建初始化目录和数据库"><a href="#1、创建初始化目录和数据库" class="headerlink" title="1、创建初始化目录和数据库"></a>1、创建初始化目录和数据库</h3><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">echo</span> <span class="token string">'net.ipv4.ip_forward = 1'</span> <span class="token operator">|</span> <span class="token function">tee</span> <span class="token parameter variable">-a</span> /etc/sysctl.conf
<span class="token builtin class-name">echo</span> <span class="token string">'net.ipv6.conf.all.forwarding = 1'</span> <span class="token operator">|</span> <span class="token function">tee</span> <span class="token parameter variable">-a</span> /etc/sysctl.conf
<span class="token function">sysctl</span> <span class="token parameter variable">-p</span> /etc/sysctl.conf

<span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /data/headscale/config
<span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /data/headscale/data
<span class="token builtin class-name">cd</span> /data/headscale/data
<span class="token function">touch</span> db.sqlite
<span class="token builtin class-name">cd</span> /data/headscale/config<span class="token punctuation">;</span>
<span class="token comment">#下载模板配置文件</span>
 <span class="token function">wget</span> https://github.com/juanfont/headscale/raw/main/config-example.yaml
 
<span class="token comment">#代理下载任何GitHub下载加上：https://ghproxy.com/</span>
 <span class="token function">wget</span> https://ghproxy.com/https://github.com/juanfont/headscale/raw/main/config-example.yaml<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="2、修改配置文件"><a href="#2、修改配置文件" class="headerlink" title="2、修改配置文件"></a>2、修改配置文件</h3><h4 id="2-1-参数注释"><a href="#2-1-参数注释" class="headerlink" title="2.1 参数注释"></a>2.1 参数注释</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#注意更改公网IP或者换成域名：xxx.com</span>

需要修改的参数有：

<span class="token comment">#访问服务端的公网IP或者域名</span>

server_url

<span class="token comment">#开放的端口</span>

listen_addr

<span class="token comment">#修改/etc/headscale/private.key的存放路径</span>

private_key_path

<span class="token comment">#修改/etc/headscale/noise_private.key的存放路径</span>

private_key_path

<span class="token comment">#关闭ipv6，用不到</span>

ip_prefixes

<span class="token comment">#开启随机端口</span>

randomize_client_port

<span class="token comment">#定义数据库路径</span>

db_path

<span class="token comment">#dns改为国内223.5.5.5，可以多个</span>

nameservers<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="2-2-写入配置"><a href="#2-2-写入配置" class="headerlink" title="2.2 写入配置"></a>2.2 写入配置</h4><p>vim &#x2F;data&#x2F;headscale&#x2F;config&#x2F;config.yaml</p>
<pre class="line-numbers language-yaml" data-language="yaml"><code class="language-yaml"><span class="token punctuation">---</span>
<span class="token key atrule">server_url</span><span class="token punctuation">:</span> http<span class="token punctuation">:</span>//headscale.xxx.com<span class="token punctuation">:</span><span class="token number">8080</span>
<span class="token key atrule">listen_addr</span><span class="token punctuation">:</span> 0.0.0.0<span class="token punctuation">:</span><span class="token number">8080</span>
<span class="token key atrule">metrics_listen_addr</span><span class="token punctuation">:</span> 127.0.0.1<span class="token punctuation">:</span><span class="token number">9090</span>
<span class="token key atrule">grpc_listen_addr</span><span class="token punctuation">:</span> 127.0.0.1<span class="token punctuation">:</span><span class="token number">50443</span>
<span class="token key atrule">grpc_allow_insecure</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
<span class="token key atrule">private_key_path</span><span class="token punctuation">:</span> /var/lib/headscale/private.key
<span class="token key atrule">noise</span><span class="token punctuation">:</span>
  <span class="token key atrule">private_key_path</span><span class="token punctuation">:</span> /var/lib/headscale/noise_private.key
<span class="token key atrule">ip_prefixes</span><span class="token punctuation">:</span>
  <span class="token punctuation">-</span> 100.64.0.0/10
<span class="token key atrule">derp</span><span class="token punctuation">:</span>
  <span class="token key atrule">server</span><span class="token punctuation">:</span>
    <span class="token key atrule">enabled</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
    <span class="token key atrule">region_id</span><span class="token punctuation">:</span> <span class="token number">999</span>
    <span class="token key atrule">region_code</span><span class="token punctuation">:</span> <span class="token string">"headscale"</span>
    <span class="token key atrule">region_name</span><span class="token punctuation">:</span> <span class="token string">"Headscale Embedded DERP"</span>
    <span class="token key atrule">stun_listen_addr</span><span class="token punctuation">:</span> <span class="token string">"0.0.0.0:3478"</span>
  <span class="token key atrule">urls</span><span class="token punctuation">:</span>
    <span class="token punctuation">-</span> https<span class="token punctuation">:</span>//controlplane.tailscale.com/derpmap/default
  <span class="token key atrule">paths</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>
  <span class="token key atrule">auto_update_enabled</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>
  <span class="token key atrule">update_frequency</span><span class="token punctuation">:</span> 24h
<span class="token key atrule">disable_check_updates</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
<span class="token key atrule">ephemeral_node_inactivity_timeout</span><span class="token punctuation">:</span> 30m
<span class="token key atrule">node_update_check_interval</span><span class="token punctuation">:</span> 10s
<span class="token key atrule">db_type</span><span class="token punctuation">:</span> sqlite3
<span class="token key atrule">db_path</span><span class="token punctuation">:</span> /var/lib/headscale/db.sqlite
<span class="token key atrule">acme_url</span><span class="token punctuation">:</span> https<span class="token punctuation">:</span>//acme<span class="token punctuation">-</span>v02.api.letsencrypt.org/directory
<span class="token key atrule">acme_email</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">tls_letsencrypt_hostname</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">tls_letsencrypt_cache_dir</span><span class="token punctuation">:</span> /var/lib/headscale/cache
<span class="token key atrule">tls_letsencrypt_challenge_type</span><span class="token punctuation">:</span> HTTP<span class="token punctuation">-</span><span class="token number">01</span>
<span class="token key atrule">tls_letsencrypt_listen</span><span class="token punctuation">:</span> <span class="token string">":http"</span>
<span class="token key atrule">tls_cert_path</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">tls_key_path</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">log</span><span class="token punctuation">:</span>
  <span class="token key atrule">format</span><span class="token punctuation">:</span> text
  <span class="token key atrule">level</span><span class="token punctuation">:</span> info
<span class="token key atrule">acl_policy_path</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">dns_config</span><span class="token punctuation">:</span>
  <span class="token key atrule">override_local_dns</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>
  <span class="token key atrule">nameservers</span><span class="token punctuation">:</span>
    <span class="token punctuation">-</span> 223.5.5.5
    <span class="token punctuation">-</span> 114.114.114.114
    <span class="token punctuation">-</span> 8.8.8.8
    <span class="token punctuation">-</span> 1.1.1.1
  <span class="token key atrule">domains</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>
  <span class="token key atrule">magic_dns</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>
  <span class="token key atrule">base_domain</span><span class="token punctuation">:</span> example.com
<span class="token key atrule">unix_socket</span><span class="token punctuation">:</span> /var/run/headscale/headscale.sock
<span class="token key atrule">unix_socket_permission</span><span class="token punctuation">:</span> <span class="token string">"0770"</span>
<span class="token key atrule">logtail</span><span class="token punctuation">:</span>
  <span class="token key atrule">enabled</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
<span class="token key atrule">randomize_client_port</span><span class="token punctuation">:</span> <span class="token boolean important">true</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="3、启动docker服务"><a href="#3、启动docker服务" class="headerlink" title="3、启动docker服务"></a>3、启动docker服务</h3><p>服务端操作，前提是自己安装好docekr服务，百度一大把</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash">
<span class="token function">docker</span> run <span class="token parameter variable">-d</span> <span class="token parameter variable">--name</span> headscale <span class="token parameter variable">--restart</span> always <span class="token parameter variable">-v</span> /data/headscale/config:/etc/headscale/ <span class="token parameter variable">-p</span> <span class="token number">8089</span>:8089 <span class="token parameter variable">-p</span> <span class="token number">9090</span>:9090 headscale/headscale:0.22.3 headscale serve

<span class="token comment">#进入容器并创建默认用户</span>
<span class="token function">docker</span> <span class="token builtin class-name">exec</span> <span class="token parameter variable">-it</span> headscale <span class="token function">bash</span>
headscale <span class="token function">users</span> create default
<span class="token comment">#生成24小时密钥,注意下面密钥客户端加入需要用到</span>
headscale preauthkeys create <span class="token parameter variable">--user</span> default <span class="token parameter variable">--reusable</span> <span class="token parameter variable">--expiration</span> 24h
<span class="token comment">#下面是输出信息</span>
a8438d05e623563aa908b1c190d56e2f2547e3713da693b7

<span class="token comment">#退出容器</span>
<span class="token builtin class-name">exit</span>
<span class="token comment">#安装客户端--advertise-routes=参数是运行连接客户端可以被访问的网段比如内网（可选）</span>
<span class="token comment">#如果安装慢可以选择手动安装</span>
<span class="token function">curl</span> <span class="token parameter variable">-fsSL</span> https://tailscale.com/install.sh <span class="token operator">|</span> <span class="token function">sh</span>
<span class="token comment">#（可选）</span>
tailscale up --login-server<span class="token operator">=</span>http://xxx.com:8089 --accept-routes<span class="token operator">=</span>true --accept-dns<span class="token operator">=</span>false --advertise-routes<span class="token operator">=</span><span class="token number">10.10</span>.1.0/24 <span class="token parameter variable">--authkey</span> a8438d05e623563aa908b1c190d56e2f2547e3713da693b7
<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="3-1-1-docker-compose方式"><a href="#3-1-1-docker-compose方式" class="headerlink" title="3.1.1 docker-compose方式"></a>3.1.1 docker-compose方式</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash">

<span class="token function">cat</span> <span class="token operator">></span> /data/headscale/docker-compose.yml <span class="token operator">&lt;&lt;</span> <span class="token string">EOF
version: "3.4"

services:
  headscale:
    image: headscale/headscale:0.22.3
    container_name: headscale
    restart: unless-stopped
    entrypoint: headscale serve
    volumes:
      - /data/headscale/config:/etc/headscale/
      - /data/headscale/data:/var/lib/headscale/
    ports:
      - "53450:8080"
      - "9090:9090"
EOF</span>

<span class="token comment">#启动容器</span>
<span class="token builtin class-name">cd</span> /data/headscale/<span class="token punctuation">;</span>
<span class="token function">docker-compose</span> <span class="token parameter variable">-f</span> docker-compose.yml up <span class="token parameter variable">-d</span> --force-recreate


代证书https测试

      
<span class="token function">cat</span> <span class="token operator">></span> /data/headscale/docker-compose.yml <span class="token operator">&lt;&lt;</span> <span class="token string">EOF
version: "3.4"

services:
  headscale:
    image: headscale/headscale:0.22.3
    container_name: headscale
    restart: unless-stopped
    entrypoint: headscale serve
    volumes:
      - /data/headscale/config:/etc/headscale/
      - /data/headscale/data:/var/lib/headscale/
    ports:
      - "53450:8080"
      - "9090:9090"

cat > /data/caddy/docker-compose.yml &lt;&lt; EOF
version: "3.4"
services:
  caddy:
    image: caddy:2.7.4
    container_name: caddy
    restart: unless-stopped
    volumes:
      - /data/caddy/Caddyfile:/etc/caddy/Caddyfile
      - /data/caddy/certs:/root/certs
      - caddy_data:/data
      - caddy_conf:/config
    ports:
      - "80:80"
      - "443:443"

volumes:
  caddy_data: &#123; &#125;
  caddy_conf: &#123; &#125;
EOF</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>



<h3 id="4、客户端加入"><a href="#4、客户端加入" class="headerlink" title="4、客户端加入"></a>4、客户端加入</h3><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#客户端安装，如果安装慢可以选择手动安装</span>
<span class="token function">curl</span> <span class="token parameter variable">-fsSL</span> https://tailscale.com/install.sh <span class="token operator">|</span> <span class="token function">sh</span>

<span class="token comment">#--advertise-routes=参数是运行连接客户端可以被访问的网段比如内网</span>
tailscale up --login-server<span class="token operator">=</span>http://xxx.com:8089 --accept-routes<span class="token operator">=</span>true --accept-dns<span class="token operator">=</span>false --advertise-routes<span class="token operator">=</span><span class="token number">192.168</span>.1.0/24 <span class="token parameter variable">--authkey</span> a8438d05e623563aa908b1c190d56e2f2547e3713da693b7

<span class="token comment">#添加多个访问网段，重新加入步骤</span>
tailscale down
tailscale up --login-server<span class="token operator">=</span>http://xxx.com:8089 --accept-routes<span class="token operator">=</span>true --accept-dns<span class="token operator">=</span>false --advertise-routes<span class="token operator">=</span><span class="token string">"192.168.1.0/24,172.168.1.0/24"</span> <span class="token parameter variable">--reset</span> <span class="token parameter variable">--authkey</span> a8438d05e623563aa908b1c190d56e2f2547e3713da693b7<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="5、允许路由访问"><a href="#5、允许路由访问" class="headerlink" title="5、允许路由访问"></a>5、允许路由访问</h3><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#进入容器并创建默认用户</span>
<span class="token function">docker</span> <span class="token builtin class-name">exec</span> <span class="token parameter variable">-it</span> headscale <span class="token function">bash</span>

<span class="token comment">#查看加入的节点信息</span>
root@c532c6ca56ae:/<span class="token comment"># headscale nodes list</span>
ID <span class="token operator">|</span> Hostname  <span class="token operator">|</span> Name      <span class="token operator">|</span> MachineKey <span class="token operator">|</span> NodeKey <span class="token operator">|</span> User <span class="token operator">|</span> IP addresses <span class="token operator">|</span> Ephemeral <span class="token operator">|</span> Last seen           <span class="token operator">|</span> Expiration          <span class="token operator">|</span> Online <span class="token operator">|</span> Expired
<span class="token number">1</span>  <span class="token operator">|</span> localhost <span class="token operator">|</span> localhost <span class="token operator">|</span> <span class="token punctuation">[</span>HLoyZ<span class="token punctuation">]</span>    <span class="token operator">|</span> <span class="token punctuation">[</span>ZIiB/<span class="token punctuation">]</span> <span class="token operator">|</span> <span class="token builtin class-name">test</span> <span class="token operator">|</span> <span class="token number">100.64</span>.0.1, <span class="token operator">|</span> <span class="token boolean">false</span>     <span class="token operator">|</span> <span class="token number">2023</span>-08-16 05:36:02 <span class="token operator">|</span> 0001-01-01 00:00:00 <span class="token operator">|</span> online <span class="token operator">|</span> no

<span class="token comment">#查看路由信息</span>
root@c532c6ca56ae:/<span class="token comment"># headscale routes list -i 1</span>
ID <span class="token operator">|</span> Machine   <span class="token operator">|</span> Prefix           <span class="token operator">|</span> Advertised <span class="token operator">|</span> Enabled <span class="token operator">|</span> Primary
<span class="token number">1</span>  <span class="token operator">|</span> localhost <span class="token operator">|</span> <span class="token number">165.198</span>.105.0/24 <span class="token operator">|</span> <span class="token boolean">true</span>       <span class="token operator">|</span> <span class="token boolean">false</span>   <span class="token operator">|</span> <span class="token boolean">false</span>
<span class="token comment">#允许路由访问</span>
root@c532c6ca56ae:/<span class="token comment"># headscale routes enable -r 1 "165.198.105.0/24"</span>
<span class="token comment">#再次查看确认Enabled | Primary 是否等于true</span>
root@c532c6ca56ae:/<span class="token comment"># headscale routes list -i 1</span>
ID <span class="token operator">|</span> Machine   <span class="token operator">|</span> Prefix           <span class="token operator">|</span> Advertised <span class="token operator">|</span> Enabled <span class="token operator">|</span> Primary
<span class="token number">1</span>  <span class="token operator">|</span> localhost <span class="token operator">|</span> <span class="token number">165.198</span>.105.0/24 <span class="token operator">|</span> <span class="token boolean">true</span>       <span class="token operator">|</span> <span class="token boolean">true</span>    <span class="token operator">|</span> <span class="token boolean">true</span>

<span class="token comment">#允许所有效果相同于headscale routes enable -r 1 "165.198.105.0/24"命令</span>
root@c532c6ca56ae:/<span class="token comment"># headscale routes enable -i 1 -a</span>
root@c532c6ca56ae:/<span class="token comment"># headscale routes list -i 1</span>
ID <span class="token operator">|</span> Machine   <span class="token operator">|</span> Prefix           <span class="token operator">|</span> Advertised <span class="token operator">|</span> Enabled <span class="token operator">|</span> Primary
<span class="token number">1</span>  <span class="token operator">|</span> localhost <span class="token operator">|</span> <span class="token number">165.198</span>.105.0/24 <span class="token operator">|</span> <span class="token boolean">true</span>       <span class="token operator">|</span> <span class="token boolean">true</span>    <span class="token operator">|</span> <span class="token boolean">true</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="6、测试ping"><a href="#6、测试ping" class="headerlink" title="6、测试ping"></a>6、测试ping</h3><p>要放开icmp协议或者防火墙</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash">服务端测试ping
root@test:/<span class="token comment"># ping 100.64.0.1</span>
PING <span class="token number">100.64</span>.0.1 <span class="token punctuation">(</span><span class="token number">100.64</span>.0.1<span class="token punctuation">)</span> <span class="token number">56</span><span class="token punctuation">(</span><span class="token number">84</span><span class="token punctuation">)</span> bytes of data.
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">1</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">79.1</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">2</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">79.2</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">3</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">84.9</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">4</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.0</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">5</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.5</span> ms

<span class="token comment">#客户端测试ping</span>
root@localhost:~<span class="token comment"># ping 100.64.0.2</span>
PING <span class="token number">100.64</span>.0.2 <span class="token punctuation">(</span><span class="token number">100.64</span>.0.2<span class="token punctuation">)</span> <span class="token number">56</span><span class="token punctuation">(</span><span class="token number">84</span><span class="token punctuation">)</span> bytes of data.
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.2: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">1</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.4</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.2: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">2</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.5</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.2: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">3</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.1</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.2: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">4</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.5</span> ms
<span class="token number">64</span> bytes from <span class="token number">100.64</span>.0.2: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">5</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">64</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.7</span> ms

<span class="token comment">#服务端测试ping客户端内网IP</span>
root@test:/<span class="token comment"># ping 192.168.1.1</span>
PING <span class="token number">192.168</span>.1.1 <span class="token punctuation">(</span><span class="token number">192.168</span>.1.1<span class="token punctuation">)</span> <span class="token number">56</span><span class="token punctuation">(</span><span class="token number">84</span><span class="token punctuation">)</span> bytes of data.
<span class="token number">64</span> bytes from <span class="token number">192.168</span>.1.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">1</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">63</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">88.8</span> ms
<span class="token number">64</span> bytes from <span class="token number">192.168</span>.1.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">2</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">63</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.2</span> ms
<span class="token number">64</span> bytes from <span class="token number">192.168</span>.1.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">3</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">63</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">87.1</span> ms
<span class="token number">64</span> bytes from <span class="token number">192.168</span>.1.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">4</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">63</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">86.1</span> ms
<span class="token number">64</span> bytes from <span class="token number">192.168</span>.1.1: <span class="token assign-left variable">icmp_seq</span><span class="token operator">=</span><span class="token number">5</span> <span class="token assign-left variable">ttl</span><span class="token operator">=</span><span class="token number">63</span> <span class="token assign-left variable">time</span><span class="token operator">=</span><span class="token number">83.3</span> ms<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="7、二进制客户端手动安装篇（可选）"><a href="#7、二进制客户端手动安装篇（可选）" class="headerlink" title="7、二进制客户端手动安装篇（可选）"></a>7、二进制客户端手动安装篇（可选）</h3><p>（可选参考）</p>
<p>前面用脚本安装了，就不要操作了，适合手动安装模式</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#下载官方二进制包</span>
<span class="token function">wget</span> https://pkgs.tailscale.com/stable/tailscale_1.48.1_amd64.tgz
<span class="token comment">#解压</span>
<span class="token function">tar</span> xf tailscale_1.48.1_amd64.tgz

<span class="token comment">#将二进制文件复制到官方软件包默认的路径下</span>
<span class="token function">cp</span> tailscale_1.48.1_amd64/tailscaled /usr/sbin/tailscaled
<span class="token function">cp</span> tailscale_1.48.1_amd64/tailscale /usr/bin/tailscale

<span class="token comment">#将 systemD service 配置文件复制到系统路径下：</span>
<span class="token function">cp</span> tailscale_1.48.1_amd64/systemd/tailscaled.service /lib/systemd/system/tailscaled.service

<span class="token comment">#将环境变量配置文件复制到系统路径下：</span>
<span class="token function">cp</span> tailscale_1.48.1_amd64/systemd/tailscaled.defaults /etc/default/tailscaled
<span class="token comment">#开机启动和启动</span>
systemctl <span class="token builtin class-name">enable</span> <span class="token parameter variable">--now</span> tailscaled
<span class="token comment">#查看状态</span>
systemctl status tailscaled<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="windows客户端提示"><a href="#windows客户端提示" class="headerlink" title="windows客户端提示"></a>windows客户端提示</h3><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash">最新的tailscale版本（1.34.0 及更高版本）
tailscale在 <span class="token number">1.34</span> 版中添加了快速用户切换，您现在可以使用 新的登录命令，用于连接到一个或多个tailscale 服务器。以前使用的配置文件不再起作用。

使用Tailscale的登录命令添加您的个人资料：
tailscale login --login-server https://headscale.amjun.com

<span class="token comment">################################################</span>
Windows 注册表配置（1.32.0 及更低版本）
此页面提供官方 Windows 的 Windows 注册表信息 tailscale客户端。

注册表文件将配置尾标以用作 其控制服务器。https://headscale.amjun.com

谨慎
在安装之前，应始终下载并检查注册表文件 它：

<span class="token function">curl</span> https://headscale.amjun.com/windows/tailscale.reg<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h3 id="8、部署derp中转服务器"><a href="#8、部署derp中转服务器" class="headerlink" title="8、部署derp中转服务器"></a>8、部署derp中转服务器</h3><p>此教程适合家用家庭公网宽带使用，纯公网IP的。</p>
<h4 id="8-1-1-安装go服务环境"><a href="#8-1-1-安装go服务环境" class="headerlink" title="8.1.1 安装go服务环境"></a>8.1.1 安装go服务环境</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#安装必要的工具</span>
<span class="token function">apt</span> <span class="token function">install</span> <span class="token parameter variable">-y</span> <span class="token function">wget</span> <span class="token function">git</span> openssl <span class="token function">curl</span>

<span class="token builtin class-name">cd</span> /root/<span class="token punctuation">;</span><span class="token function">mkdir</span> go<span class="token punctuation">;</span><span class="token builtin class-name">cd</span> go<span class="token punctuation">;</span>
<span class="token function">wget</span> https://go.dev/dl/go1.21.0.linux-amd64.tar.gz

<span class="token function">rm</span> <span class="token parameter variable">-rf</span> /usr/local/go <span class="token operator">&amp;&amp;</span> <span class="token function">tar</span> <span class="token parameter variable">-C</span> /usr/local <span class="token parameter variable">-xzf</span> go1.21.0.linux-amd64.tar.gz

<span class="token builtin class-name">export</span> <span class="token assign-left variable"><span class="token environment constant">PATH</span></span><span class="token operator">=</span><span class="token environment constant">$PATH</span>:/usr/local/go/bin
go version
 
<span class="token builtin class-name">echo</span> <span class="token string">"export PATH=<span class="token environment constant">$PATH</span>:/usr/local/go/bin"</span> <span class="token operator">>></span> /etc/profile
<span class="token builtin class-name">source</span> /etc/profile

go <span class="token function">env</span> <span class="token parameter variable">-w</span> <span class="token assign-left variable">GO111MODULE</span><span class="token operator">=</span>on
go <span class="token function">env</span> <span class="token parameter variable">-w</span> <span class="token assign-left variable">GOPROXY</span><span class="token operator">=</span>https://goproxy.cn,direct

go <span class="token function">install</span> tailscale.com/cmd/derper@main

<span class="token builtin class-name">cd</span> ~/go/pkg/mod/tailscale.com<span class="token punctuation">\</span>@v1.1.1-0.20230818020430-af2e4909b6e9/cmd/derper
<span class="token function">chmod</span> +w cert.go
<span class="token function">vim</span> cert.go


<span class="token comment">#将这段代码的if hi.ServerName != m.hostname，return nil……，&#125;加上//注释掉，注释3行保存</span>
func <span class="token punctuation">(</span>m *manualCertManager<span class="token punctuation">)</span> getCertificate<span class="token punctuation">(</span>hi *tls.ClientHelloInfo<span class="token punctuation">)</span> <span class="token punctuation">(</span>*tls.Certificate, error<span class="token punctuation">)</span> <span class="token punctuation">&#123;</span>
        //if hi.ServerName <span class="token operator">!=</span> m.hostname <span class="token punctuation">&#123;</span>   这行注释
        // fmt.Errorf<span class="token punctuation">(</span><span class="token string">"cert mismatch with hostname: %q"</span>, hi.ServerName<span class="token punctuation">)</span>  这行注释
        //<span class="token punctuation">&#125;</span>  这行注释

        // Return a shallow copy of the cert so the <span class="token builtin class-name">caller</span> can append to its
        // Certificate field.
        certCopy :<span class="token operator">=</span> new<span class="token punctuation">(</span>tls.Certificate<span class="token punctuation">)</span>
        *certCopy <span class="token operator">=</span> *m.cert
        certCopy.Certificate <span class="token operator">=</span> certCopy.Certificate<span class="token punctuation">[</span>:len<span class="token punctuation">(</span>certCopy.Certificate<span class="token punctuation">)</span>:len<span class="token punctuation">(</span>certCopy.Certificate<span class="token punctuation">)</span><span class="token punctuation">]</span>
        <span class="token builtin class-name">return</span> certCopy, nil
<span class="token punctuation">&#125;</span>

<span class="token comment">#创建derp目录</span>
<span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /etc/derp
<span class="token function">rm</span> <span class="token parameter variable">-rf</span> /etc/derp/derper <span class="token operator">&amp;&amp;</span> go build <span class="token parameter variable">-o</span> /etc/derp/derper
<span class="token function">ls</span> /etc/derp
<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="8-1-2-创建自签证书和derp服务"><a href="#8-1-2-创建自签证书和derp服务" class="headerlink" title="8.1.2 创建自签证书和derp服务"></a>8.1.2 创建自签证书和derp服务</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash">
openssl req <span class="token parameter variable">-x509</span> <span class="token parameter variable">-newkey</span> rsa:4096 <span class="token parameter variable">-sha256</span> <span class="token parameter variable">-days</span> <span class="token number">36500</span> <span class="token parameter variable">-nodes</span> <span class="token parameter variable">-keyout</span> /etc/derp/derp.poc.test.com.key <span class="token parameter variable">-out</span> /etc/derp/derp.poc.test.com.crt <span class="token parameter variable">-subj</span> <span class="token string">"/CN=derp.poc.test.com"</span> <span class="token parameter variable">-addext</span> <span class="token string">"subjectAltName=DNS:derp.poc.test.com"</span>


<span class="token comment">#如果需要防白嫖可以在ExecStart=/etc/derp/derper后面加上这个参数，但derp节点需要加入到同样vpn中</span>
--verify-clients

<span class="token function">cat</span> <span class="token operator">></span> /etc/systemd/system/derp.service <span class="token operator">&lt;&lt;</span><span class="token string">EOF
[Unit]
Description=TS Derper
After=network.target
Wants=network.target
[Service]
User=root
Restart=always
ExecStart=/etc/derp/derper -hostname derp.poc.test.com -a :33445 -http-port 33446 -stun-port 13478 -certmode manual -certdir /etc/derp
RestartPreventExitStatus=1
[Install]
WantedBy=multi-user.target
EOF</span>

 
systemctl daemon-reload
systemctl <span class="token builtin class-name">enable</span> derp
systemctl restart derp

<span class="token comment">#自己建一个nginx，可以get的到，注意，可以是域名或者ip，如果是家庭公网域名，需要在本地/etc/hosts做本地解析，要不然是连接不上derp服务器。其它客户端不用本地解析</span>
<span class="token punctuation">&#123;</span>
    <span class="token string">"Regions"</span><span class="token builtin class-name">:</span> <span class="token punctuation">&#123;</span>
        <span class="token string">"901"</span><span class="token builtin class-name">:</span> <span class="token punctuation">&#123;</span>
            <span class="token string">"RegionID"</span><span class="token builtin class-name">:</span>   <span class="token number">901</span>,
            <span class="token string">"RegionCode"</span><span class="token builtin class-name">:</span> <span class="token string">"my-home-node"</span>,
            <span class="token string">"RegionName"</span><span class="token builtin class-name">:</span> <span class="token string">"my-home-node-Derper"</span>,
            <span class="token string">"Nodes"</span><span class="token builtin class-name">:</span> <span class="token punctuation">[</span>
                    <span class="token punctuation">&#123;</span>
                    <span class="token string">"Name"</span><span class="token builtin class-name">:</span>             <span class="token string">"901a"</span>,
                    <span class="token string">"RegionID"</span><span class="token builtin class-name">:</span>          <span class="token number">901</span>,
                    <span class="token string">"DERPPort"</span><span class="token builtin class-name">:</span>         <span class="token number">33445</span>,
                    <span class="token string">"STUNPort"</span><span class="token builtin class-name">:</span>         <span class="token number">13478</span>,
                    <span class="token string">"STUNOnly"</span><span class="token builtin class-name">:</span>         false,
                    <span class="token string">"HostName"</span><span class="token builtin class-name">:</span> <span class="token string">"xxx.com"</span>,
                    <span class="token string">"InsecureForTests"</span><span class="token builtin class-name">:</span> <span class="token boolean">true</span>
                <span class="token punctuation">&#125;</span>
            <span class="token punctuation">]</span>
        <span class="token punctuation">&#125;</span>
    <span class="token punctuation">&#125;</span>
<span class="token punctuation">&#125;</span>

 
<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="8-1-3-配置headscale的derp服务"><a href="#8-1-3-配置headscale的derp服务" class="headerlink" title="8.1.3 配置headscale的derp服务"></a>8.1.3 配置headscale的derp服务</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"> <span class="token comment">#修改headscale配置，并重启headscale服务</span>
 <span class="token function">vim</span> /data/headscale/config/config.yaml
 derp:
  server:
    <span class="token comment"># If enabled, runs the embedded DERP server and merges it into the rest of the DERP config</span>
    <span class="token comment"># The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place,把这个改为true</span>
    enabled: <span class="token boolean">true</span>
    <span class="token comment"># Region ID to use for the embedded DERP server.</span>
    <span class="token comment"># The local DERP prevails if the region ID collides with other region ID coming from</span>
    <span class="token comment"># the regular DERP config.</span>
    region_id: <span class="token number">999</span>
    <span class="token comment"># Region code and name are displayed in the Tailscale UI to identify a DERP region</span>
    region_code: <span class="token string">"headscale"</span>
    region_name: <span class="token string">"Headscale Embedded DERP"</span>
    <span class="token comment"># Listens over UDP at the configured address for STUN connections - to help with NAT traversal.</span>
    <span class="token comment"># When the embedded DERP server is enabled stun_listen_addr MUST be defined.</span>
    <span class="token comment">#</span>
    <span class="token comment"># For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/</span>
    stun_listen_addr: <span class="token string">"0.0.0.0:3478"</span>
  <span class="token comment"># List of externally available DERP maps encoded in JSON,把你公开的derp链接放到这里去。注释官方链接</span>
  urls:
    <span class="token comment">#- https://controlplane.tailscale.com/derpmap/default</span>
    - https://xxx

<span class="token comment">#重启服务生效</span>
<span class="token function">docker</span> restart headscale<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="8-1-4-把端口映射或者防火墙放开33445-x2F-tcp和13478-x2F-udp端口"><a href="#8-1-4-把端口映射或者防火墙放开33445-x2F-tcp和13478-x2F-udp端口" class="headerlink" title="8.1.4 把端口映射或者防火墙放开33445&#x2F;tcp和13478&#x2F;udp端口"></a>8.1.4 把端口映射或者防火墙放开33445&#x2F;tcp和13478&#x2F;udp端口</h4><h3 id="9、二进制安装headscale服务端（测试）"><a href="#9、二进制安装headscale服务端（测试）" class="headerlink" title="9、二进制安装headscale服务端（测试）"></a>9、二进制安装headscale服务端（测试）</h3><h4 id="9-1-1-下载服务端文件"><a href="#9-1-1-下载服务端文件" class="headerlink" title="9.1.1 下载服务端文件"></a>9.1.1 下载服务端文件</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#挑选适合自己环境的版本下载</span>
https://github.com/juanfont/headscale/releases

<span class="token comment">#比如</span>
<span class="token function">mkdir</span> /etc/headscale<span class="token punctuation">;</span><span class="token builtin class-name">cd</span> /etc/headscale
<span class="token function">touch</span> db.sqlite

<span class="token function">wget</span> https://github.com/juanfont/headscale/releases/download/v0.22.3/headscale_0.22.3_linux_amd64

<span class="token comment">#下载后，放到/etc/headscale目录里</span>
<span class="token function">cp</span> headscale_0.22.3_linux_amd64 /usr/bin/headscale
<span class="token function">chmod</span> +x /usr/bin/headscale

<span class="token builtin class-name">echo</span> <span class="token string">'net.ipv4.ip_forward = 1'</span> <span class="token operator">|</span> <span class="token function">tee</span> <span class="token parameter variable">-a</span> /etc/sysctl.conf
<span class="token builtin class-name">echo</span> <span class="token string">'net.ipv6.conf.all.forwarding = 1'</span> <span class="token operator">|</span> <span class="token function">tee</span> <span class="token parameter variable">-a</span> /etc/sysctl.conf
<span class="token function">sysctl</span> <span class="token parameter variable">-p</span> /etc/sysctl.conf<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="9-1-2-配置启动文件"><a href="#9-1-2-配置启动文件" class="headerlink" title="9.1.2 配置启动文件"></a>9.1.2 配置启动文件</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token function">cat</span> <span class="token operator">></span> /lib/systemd/system/headscale.service <span class="token operator">&lt;&lt;</span> <span class="token string">EOF
[Unit]
After=syslog.target
After=network.target
Description=headscale coordination server for Tailscale
X-Restart-Triggers=/etc/headscale/config.yaml

[Service]
Type=simple
User=root
Group=root
ExecStart=/usr/bin/headscale serve
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="9-1-3-配置服务端配置"><a href="#9-1-3-配置服务端配置" class="headerlink" title="9.1.3 配置服务端配置"></a>9.1.3 配置服务端配置</h4><p>vim &#x2F;etc&#x2F;headscale&#x2F;config.yaml</p>
<pre class="line-numbers language-yaml" data-language="yaml"><code class="language-yaml"><span class="token punctuation">---</span>
<span class="token key atrule">server_url</span><span class="token punctuation">:</span> http<span class="token punctuation">:</span>//xxx.com<span class="token punctuation">:</span><span class="token number">8089</span>
<span class="token key atrule">listen_addr</span><span class="token punctuation">:</span> 0.0.0.0<span class="token punctuation">:</span><span class="token number">8089</span>
<span class="token key atrule">metrics_listen_addr</span><span class="token punctuation">:</span> 127.0.0.1<span class="token punctuation">:</span><span class="token number">9090</span>
<span class="token key atrule">grpc_listen_addr</span><span class="token punctuation">:</span> 127.0.0.1<span class="token punctuation">:</span><span class="token number">50443</span>
<span class="token key atrule">grpc_allow_insecure</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
<span class="token key atrule">private_key_path</span><span class="token punctuation">:</span> /etc/headscale/private.key
<span class="token key atrule">noise</span><span class="token punctuation">:</span>
  <span class="token comment"># The Noise private key is used to encrypt the</span>
  <span class="token comment"># traffic between headscale and Tailscale clients when</span>
  <span class="token comment"># using the new Noise-based protocol. It must be different</span>
  <span class="token comment"># from the legacy private key.</span>
  <span class="token key atrule">private_key_path</span><span class="token punctuation">:</span> /etc/headscale/noise_private.key
  <span class="token comment">#private_key_path: /var/lib/headscale/noise_private.key</span>
<span class="token key atrule">ip_prefixes</span><span class="token punctuation">:</span>
  <span class="token comment">#- fd7a:115c:a1e0::/48</span>
  <span class="token punctuation">-</span> 100.64.0.0/10
<span class="token key atrule">derp</span><span class="token punctuation">:</span>
  <span class="token key atrule">server</span><span class="token punctuation">:</span>
    <span class="token comment"># If enabled, runs the embedded DERP server and merges it into the rest of the DERP config</span>
    <span class="token comment"># The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place</span>
    <span class="token key atrule">enabled</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
    <span class="token comment"># Region ID to use for the embedded DERP server.</span>
    <span class="token comment"># The local DERP prevails if the region ID collides with other region ID coming from</span>
    <span class="token comment"># the regular DERP config.</span>
    <span class="token key atrule">region_id</span><span class="token punctuation">:</span> <span class="token number">999</span>
    <span class="token comment"># Region code and name are displayed in the Tailscale UI to identify a DERP region</span>
    <span class="token key atrule">region_code</span><span class="token punctuation">:</span> <span class="token string">"headscale"</span>
    <span class="token key atrule">region_name</span><span class="token punctuation">:</span> <span class="token string">"Headscale Embedded DERP"</span>
    <span class="token comment"># Listens over UDP at the configured address for STUN connections - to help with NAT traversal.</span>
    <span class="token comment"># When the embedded DERP server is enabled stun_listen_addr MUST be defined.</span>
    <span class="token comment">#</span>
    <span class="token comment"># For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/</span>
    <span class="token key atrule">stun_listen_addr</span><span class="token punctuation">:</span> <span class="token string">"0.0.0.0:3478"</span>
  <span class="token comment"># List of externally available DERP maps encoded in JSON</span>
  <span class="token key atrule">urls</span><span class="token punctuation">:</span>
    <span class="token punctuation">-</span> https<span class="token punctuation">:</span>//controlplane.tailscale.com/derpmap/default
  <span class="token comment"># Locally available DERP map files encoded in YAML</span>
  <span class="token comment">#</span>
  <span class="token comment"># This option is mostly interesting for people hosting</span>
  <span class="token comment"># their own DERP servers:</span>
  <span class="token comment"># https://tailscale.com/kb/1118/custom-derp-servers/</span>
  <span class="token comment">#</span>
  <span class="token comment"># paths:</span>
  <span class="token comment">#   - /etc/headscale/derp-example.yaml</span>
  <span class="token key atrule">paths</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>
  <span class="token comment"># If enabled, a worker will be set up to periodically</span>
  <span class="token comment"># refresh the given sources and update the derpmap</span>
  <span class="token comment"># will be set up.</span>
  <span class="token key atrule">auto_update_enabled</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>
  <span class="token comment"># How often should we check for DERP updates?</span>
  <span class="token key atrule">update_frequency</span><span class="token punctuation">:</span> 24h
<span class="token key atrule">disable_check_updates</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
<span class="token key atrule">ephemeral_node_inactivity_timeout</span><span class="token punctuation">:</span> 30m
<span class="token key atrule">node_update_check_interval</span><span class="token punctuation">:</span> 10s
<span class="token key atrule">db_type</span><span class="token punctuation">:</span> sqlite3
<span class="token key atrule">db_path</span><span class="token punctuation">:</span> /etc/headscale/db.sqlite
<span class="token key atrule">acme_url</span><span class="token punctuation">:</span> https<span class="token punctuation">:</span>//acme<span class="token punctuation">-</span>v02.api.letsencrypt.org/directory
<span class="token key atrule">acme_email</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">tls_letsencrypt_hostname</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">tls_letsencrypt_cache_dir</span><span class="token punctuation">:</span> /var/lib/headscale/cache
<span class="token key atrule">tls_letsencrypt_challenge_type</span><span class="token punctuation">:</span> HTTP<span class="token punctuation">-</span><span class="token number">01</span>
<span class="token key atrule">tls_letsencrypt_listen</span><span class="token punctuation">:</span> <span class="token string">":http"</span>
<span class="token key atrule">tls_cert_path</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">tls_key_path</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">log</span><span class="token punctuation">:</span>
  <span class="token comment"># Output formatting for logs: text or json</span>
  <span class="token key atrule">format</span><span class="token punctuation">:</span> text
  <span class="token key atrule">level</span><span class="token punctuation">:</span> info
<span class="token key atrule">acl_policy_path</span><span class="token punctuation">:</span> <span class="token string">""</span>
<span class="token key atrule">dns_config</span><span class="token punctuation">:</span>
  <span class="token comment"># Whether to prefer using Headscale provided DNS or use local.</span>
  <span class="token key atrule">override_local_dns</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>
  <span class="token comment"># List of DNS servers to expose to clients.</span>
  <span class="token key atrule">nameservers</span><span class="token punctuation">:</span>
    <span class="token punctuation">-</span> 223.5.5.5
    <span class="token punctuation">-</span> 8.8.8.8
    <span class="token punctuation">-</span> 1.1.1.1
  <span class="token comment"># NextDNS (see https://tailscale.com/kb/1218/nextdns/).</span>
  <span class="token comment"># "abc123" is example NextDNS ID, replace with yours.</span>
  <span class="token comment">#</span>
  <span class="token comment"># With metadata sharing:</span>
  <span class="token comment"># nameservers:</span>
  <span class="token comment">#   - https://dns.nextdns.io/abc123</span>
  <span class="token comment">#</span>
  <span class="token comment"># Without metadata sharing:</span>
  <span class="token comment"># nameservers:</span>
  <span class="token comment">#   - 2a07:a8c0::ab:c123</span>
  <span class="token comment">#   - 2a07:a8c1::ab:c123</span>
  <span class="token comment"># Split DNS (see https://tailscale.com/kb/1054/dns/),</span>
  <span class="token comment"># list of search domains and the DNS to query for each one.</span>
  <span class="token comment">#</span>
  <span class="token comment"># restricted_nameservers:</span>
  <span class="token comment">#   foo.bar.com:</span>
  <span class="token comment">#     - 1.1.1.1</span>
  <span class="token comment">#   darp.headscale.net:</span>
  <span class="token comment">#     - 1.1.1.1</span>
  <span class="token comment">#     - 8.8.8.8</span>
  <span class="token comment"># Search domains to inject.</span>
  <span class="token key atrule">domains</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>
  <span class="token comment"># Extra DNS records</span>
  <span class="token comment"># so far only A-records are supported (on the tailscale side)</span>
  <span class="token comment"># See https://github.com/juanfont/headscale/blob/main/docs/dns-records.md#Limitations</span>
  <span class="token comment"># extra_records:</span>
  <span class="token comment">#   - name: "grafana.myvpn.example.com"</span>
  <span class="token comment">#     type: "A"</span>
  <span class="token comment">#     value: "100.64.0.3"</span>
  <span class="token comment">#</span>
  <span class="token comment">#   # you can also put it in one line</span>
  <span class="token comment">#   - &#123; name: "prometheus.myvpn.example.com", type: "A", value: "100.64.0.3" &#125;</span>
  <span class="token comment"># Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).</span>
  <span class="token comment"># Only works if there is at least a nameserver defined.</span>
  <span class="token key atrule">magic_dns</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>
  <span class="token comment"># Defines the base domain to create the hostnames for MagicDNS.</span>
  <span class="token comment"># `base_domain` must be a FQDNs, without the trailing dot.</span>
  <span class="token comment"># The FQDN of the hosts will be</span>
  <span class="token comment"># `hostname.user.base_domain` (e.g., _myhost.myuser.example.com_).</span>
  <span class="token key atrule">base_domain</span><span class="token punctuation">:</span> example.com
<span class="token key atrule">unix_socket</span><span class="token punctuation">:</span> /var/run/headscale.sock
<span class="token key atrule">unix_socket_permission</span><span class="token punctuation">:</span> <span class="token string">"0770"</span>
<span class="token key atrule">logtail</span><span class="token punctuation">:</span>
  <span class="token comment"># Enable logtail for this headscales clients.</span>
  <span class="token comment"># As there is currently no support for overriding the log server in headscale, this is</span>
  <span class="token comment"># disabled by default. Enabling this will make your clients send logs to Tailscale Inc.</span>
  <span class="token key atrule">enabled</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>
<span class="token key atrule">randomize_client_port</span><span class="token punctuation">:</span> <span class="token boolean important">true</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="9-1-4-启动服务"><a href="#9-1-4-启动服务" class="headerlink" title="9.1.4 启动服务"></a>9.1.4 启动服务</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash">systemctl daemon-reload
systemctl restart headscale
systemctl <span class="token builtin class-name">enable</span> headscale<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span></span></code></pre>

<h3 id="10、家宽公网-amp-泛域名证书配置"><a href="#10、家宽公网-amp-泛域名证书配置" class="headerlink" title="10、家宽公网&amp;泛域名证书配置"></a>10、家宽公网&amp;泛域名证书配置</h3><p>前置条件：安装好docker服务和docker-compose服务，需要域名一个，如果没域名，可以参考上面步骤自签域名来实现，自签证书不适合下面教程。</p>
<p>注意，需要在托管商dns里加入*解析，如果是静态公网IP直接修改就行了，如果是动态的IP需要通过ddns-go来实现</p>
<h4 id="10-1-1-部署ddns-go"><a href="#10-1-1-部署ddns-go" class="headerlink" title="10.1.1 部署ddns-go"></a>10.1.1 部署ddns-go</h4><p>这里是通过cloudflare来代理的，其它的自行百度ddns-go配置，这里不用ipv6，申请一个dns的toke密钥</p>
<p>注意配置secret:的访问密钥，配置用户名和密码username:xxx password: xxx，更改域名domains: xxx.com</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /data/ddns-go

<span class="token function">vim</span> /data/ddns-go/.ddns_go_config.yaml
dnsconf:
    - ipv4:
        enable: <span class="token boolean">true</span>
        gettype: url
        url: https://myip4.ipip.net,https://ddns.oray.com/checkip,https://ip.3322.net,https://4.ipw.cn,https://ifconfig.me
        netinterface: <span class="token string">""</span>
        cmd: <span class="token string">""</span>
        domains:
            - <span class="token string">'*.xxx.com'</span>
            - xxx.com
      ipv6:
        enable: <span class="token boolean">false</span>
        gettype: netInterface
        url: https://speed.neu6.edu.cn/getIP.php,https://v6.ident.me,https://6.ipw.cn
        netinterface: <span class="token string">""</span>
        cmd: <span class="token string">""</span>
        ipv6reg: <span class="token string">""</span>
        domains:
            - <span class="token string">""</span>
      dns:
        name: cloudflare
        id: <span class="token string">""</span>
        secret: nFE-xxxxxxx
      ttl: <span class="token string">""</span>
user:
    username: xxx
    password: xxx
webhook:
    webhookurl: <span class="token string">""</span>
    webhookrequestbody: <span class="token string">""</span>
    webhookheaders: <span class="token string">""</span>
notallowwanaccess: <span class="token boolean">false</span>


<span class="token function">docker</span> run <span class="token parameter variable">-d</span> <span class="token parameter variable">--name</span> ddns-go <span class="token parameter variable">--restart</span><span class="token operator">=</span>always <span class="token parameter variable">-p</span> <span class="token number">9876</span>:9876 <span class="token parameter variable">-v</span> /data/ddns-go:/root jeessy/ddns-go

<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>



<h4 id="10-1-2-注册免费证书"><a href="#10-1-2-注册免费证书" class="headerlink" title="10.1.2 注册免费证书"></a>10.1.2 注册免费证书</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#安装证书服务</span>
<span class="token function">curl</span> https://get.acme.sh <span class="token operator">|</span> <span class="token function">sh</span> <span class="token parameter variable">-s</span> <span class="token assign-left variable">email</span><span class="token operator">=</span>xxx@qq.com

<span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /data/certs/
<span class="token comment">#增加定时自动更新证书</span>
<span class="token function">crontab</span> <span class="token parameter variable">-e</span>
<span class="token number">10</span> <span class="token number">23</span> <span class="token number">1</span> */2 * /usr/bin/bash /data/certs/update-certs.sh

<span class="token comment">#编写自动更新证书脚本，我这里用的是cf的dns托管，每个运营商都不同，具体去GitHub参考acme.sh的项目</span>
<span class="token comment">#CF_Key=这个是全局api-key那个，不是区域toke</span>
<span class="token function">vim</span> /data/certs/update-certs.sh

<span class="token builtin class-name">export</span> <span class="token assign-left variable">CF_Email</span><span class="token operator">=</span><span class="token string">"xxx@qq.com"</span>
<span class="token builtin class-name">export</span> <span class="token assign-left variable">CF_Key</span><span class="token operator">=</span><span class="token string">"xxxxxxxx"</span>
/root/.acme.sh/acme.sh --install-cert <span class="token parameter variable">--issue</span> <span class="token parameter variable">--dns</span> dns_cf <span class="token parameter variable">-d</span> xxx.com <span class="token parameter variable">-d</span> <span class="token string">'*.xxx.com'</span> --key-file /data/certs/privkey.pem --fullchain-file /data/certs/fullchain.pem <span class="token parameter variable">--force</span>
<span class="token function">chmod</span> <span class="token number">644</span> /data/certs/privkey.pem

<span class="token comment">#systemctl restart derp</span>
<span class="token comment">#systemctl restart caddy</span>
<span class="token comment">#docker restart headscale</span>
<span class="token comment">#systemctl restart tailscaled</span>

<span class="token comment">#赋予执行权限</span>
<span class="token function">chmod</span> +x /data/certs/update-certs.sh
<span class="token function">bash</span> /data/certs/update-certs.sh<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<p>配置headscale为https访问</p>
<p>前提条件：需要安装好derp服务部署</p>
<h4 id="10-1-3-derp-部署"><a href="#10-1-3-derp-部署" class="headerlink" title="10.1.3 derp 部署"></a>10.1.3 derp 部署</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#derp 部署</span>
<span class="token comment">#安装必要的工具</span>
<span class="token function">apt</span> <span class="token function">install</span> <span class="token parameter variable">-y</span> <span class="token function">wget</span> <span class="token function">git</span> openssl <span class="token function">curl</span>

<span class="token builtin class-name">cd</span> /root/<span class="token punctuation">;</span><span class="token function">mkdir</span> go<span class="token punctuation">;</span><span class="token builtin class-name">cd</span> go<span class="token punctuation">;</span>
<span class="token function">wget</span> https://go.dev/dl/go1.21.0.linux-amd64.tar.gz

<span class="token function">rm</span> <span class="token parameter variable">-rf</span> /usr/local/go <span class="token operator">&amp;&amp;</span> <span class="token function">tar</span> <span class="token parameter variable">-C</span> /usr/local <span class="token parameter variable">-xzf</span> go1.21.0.linux-amd64.tar.gz

<span class="token builtin class-name">export</span> <span class="token assign-left variable"><span class="token environment constant">PATH</span></span><span class="token operator">=</span><span class="token environment constant">$PATH</span>:/usr/local/go/bin
go version
 
<span class="token builtin class-name">echo</span> <span class="token string">"export PATH=<span class="token environment constant">$PATH</span>:/usr/local/go/bin"</span> <span class="token operator">>></span> /etc/profile
<span class="token builtin class-name">source</span> /etc/profile

go <span class="token function">env</span> <span class="token parameter variable">-w</span> <span class="token assign-left variable">GO111MODULE</span><span class="token operator">=</span>on
go <span class="token function">env</span> <span class="token parameter variable">-w</span> <span class="token assign-left variable">GOPROXY</span><span class="token operator">=</span>https://goproxy.cn,direct

go <span class="token function">install</span> tailscale.com/cmd/derper@main

<span class="token comment">#注意此路径由于安装版本不同，@v1.1xxxx会有所不同，其它路径没变化</span>
<span class="token builtin class-name">cd</span> ~/go/pkg/mod/tailscale.com<span class="token punctuation">\</span>@v1.1.1-0.20230818020430-af2e4909b6e9/cmd/derper

<span class="token comment">#创建derp目录</span>
<span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /etc/derp/tls
<span class="token comment">#如果编辑过程出现版本问题，需要下载新版重新编译</span>
<span class="token function">rm</span> <span class="token parameter variable">-rf</span> /etc/derp/derper <span class="token operator">&amp;&amp;</span> go build <span class="token parameter variable">-o</span> /etc/derp/derper
<span class="token function">ls</span> /etc/derp

<span class="token comment">#如果需要防白嫖可以在ExecStart=/etc/derp/derper后面加上这个参数，但derp节点需要加入到同样vpn中</span>
--verify-clients

<span class="token comment">#注意更改域名，这里默认是使用https方式的需要开放33445https端口和13478/udp端口，stun端口可以改</span>
<span class="token function">cat</span> <span class="token operator">></span> /etc/systemd/system/derp.service <span class="token operator">&lt;&lt;</span><span class="token string">EOF
[Unit]
Description=TS Derper
After=network.target
Wants=network.target
[Service]
User=root
Restart=always
ExecStart=/etc/derp/derper -hostname derp.xxx.com -a :33445 -http-port 33446 -stun-port 13478 -certmode manual -certdir /etc/derp/tls --verify-clients
RestartPreventExitStatus=1
[Install]
WantedBy=multi-user.target
EOF</span>

<span class="token comment">#链接证书过去,注意命名文件格式</span>
<span class="token builtin class-name">cd</span> /etc/derp/tls
<span class="token function">ln</span> <span class="token parameter variable">-s</span> /data/certs/fullchain.pem derp.xxx.com.crt
<span class="token function">ln</span> <span class="token parameter variable">-s</span> /data/certs/privkey.pem derp.xxx.com.key


systemctl daemon-reload
systemctl <span class="token builtin class-name">enable</span> derp
systemctl restart derp

<span class="token comment">#在本地hosts上添加自己的derp解析</span>
<span class="token function">cat</span> <span class="token operator">>></span> /etc/hosts <span class="token operator">&lt;&lt;</span> <span class="token string">EOF
192.168.x.x derp.xxx.com
EOF</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="10-1-4-搭建caddy代理服务"><a href="#10-1-4-搭建caddy代理服务" class="headerlink" title="10.1.4 搭建caddy代理服务"></a>10.1.4 搭建caddy代理服务</h4><p>443一般都是被禁用的，自己在路由上把443，转发到你要访问的端口就行了</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /etc/caddy/<span class="token punctuation">&#123;</span>certs,www/derp<span class="token punctuation">&#125;</span><span class="token punctuation">;</span><span class="token builtin class-name">cd</span> /etc/caddy
<span class="token comment">#下载caddy二进制文件</span>
<span class="token function">wget</span> https://caddyserver.com/api/download?os<span class="token operator">=</span>linux<span class="token operator">&amp;</span><span class="token assign-left variable">arch</span><span class="token operator">=</span>amd64<span class="token operator">&amp;</span><span class="token assign-left variable">idempotency</span><span class="token operator">=</span><span class="token number">81291252395604</span>
<span class="token function">chmod</span> +x caddy_linux_amd64
<span class="token function">cp</span> caddy_linux_amd64 /usr/bin/caddy
<span class="token comment">#配置启动文件</span>
<span class="token function">vim</span> /lib/systemd/system/caddy.service

<span class="token punctuation">[</span>Unit<span class="token punctuation">]</span>
<span class="token assign-left variable">Description</span><span class="token operator">=</span>Caddy
<span class="token assign-left variable">Documentation</span><span class="token operator">=</span>https://caddyserver.com/docs/
<span class="token assign-left variable">After</span><span class="token operator">=</span>network.target network-online.target
<span class="token assign-left variable">Requires</span><span class="token operator">=</span>network-online.target

<span class="token punctuation">[</span>Service<span class="token punctuation">]</span>
<span class="token assign-left variable">Type</span><span class="token operator">=</span>notify
<span class="token assign-left variable">User</span><span class="token operator">=</span>root
<span class="token assign-left variable">Group</span><span class="token operator">=</span>root
<span class="token assign-left variable">ExecStart</span><span class="token operator">=</span>/usr/bin/caddy run <span class="token parameter variable">--environ</span> <span class="token parameter variable">--config</span> /etc/caddy/Caddyfile
<span class="token assign-left variable">ExecReload</span><span class="token operator">=</span>/usr/bin/caddy reload <span class="token parameter variable">--config</span> /etc/caddy/Caddyfile <span class="token parameter variable">--force</span>
<span class="token assign-left variable">TimeoutStopSec</span><span class="token operator">=</span>5s
<span class="token assign-left variable">LimitNOFILE</span><span class="token operator">=</span><span class="token number">1048576</span>
<span class="token assign-left variable">LimitNPROC</span><span class="token operator">=</span><span class="token number">512</span>
<span class="token assign-left variable">PrivateTmp</span><span class="token operator">=</span>true
<span class="token assign-left variable">ProtectSystem</span><span class="token operator">=</span>full
<span class="token assign-left variable">AmbientCapabilities</span><span class="token operator">=</span>CAP_NET_ADMIN CAP_NET_BIND_SERVICE

<span class="token punctuation">[</span>Install<span class="token punctuation">]</span>
<span class="token assign-left variable">WantedBy</span><span class="token operator">=</span>multi-user.target


<span class="token comment">#链接证书</span>
<span class="token builtin class-name">cd</span> /etc/caddy/certs<span class="token punctuation">;</span>
<span class="token function">ln</span> <span class="token parameter variable">-s</span> /data/certs/fullchain.pem <span class="token builtin class-name">.</span>
<span class="token function">ln</span> <span class="token parameter variable">-s</span> /data/certs/privkey.pem <span class="token builtin class-name">.</span>

<span class="token function">vim</span> /etc/caddy/Caddyfile

https://derp.xxx.com: <span class="token punctuation">&#123;</span>
        root * /etc/caddy/www/derp
        tls /etc/caddy/certs/fullchain.pem /etc/caddy/certs/privkey.pem
        file_server

        header <span class="token punctuation">&#123;</span>
                Access-Control-Allow-Origin *.xxx.com
                Strict-Transport-Security <span class="token string">"max-age=31536000;"</span>
                X-XSS-Protection <span class="token string">"1; mode=block"</span>
                X-Frame-Options <span class="token string">"SAMEORIGIN"</span>
                X-Robots-Tag <span class="token string">"none"</span>
                <span class="token parameter variable">-Server</span>
        <span class="token punctuation">&#125;</span>
<span class="token punctuation">&#125;</span>

<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<p>在线json格式为：</p>
<p>vim &#x2F;etc&#x2F;caddy&#x2F;www&#x2F;derp&#x2F;index.html</p>
<pre class="line-numbers language-json" data-language="json"><code class="language-json"><span class="token punctuation">&#123;</span>
  <span class="token property">"Regions"</span><span class="token operator">:</span> <span class="token punctuation">&#123;</span>
    <span class="token property">"901"</span><span class="token operator">:</span> <span class="token punctuation">&#123;</span>
      <span class="token property">"RegionID"</span><span class="token operator">:</span> <span class="token number">901</span><span class="token punctuation">,</span>
      <span class="token property">"RegionCode"</span><span class="token operator">:</span> <span class="token string">"my-home-node"</span><span class="token punctuation">,</span>
      <span class="token property">"RegionName"</span><span class="token operator">:</span> <span class="token string">"my-home-node-Derper"</span><span class="token punctuation">,</span>
      <span class="token property">"Nodes"</span><span class="token operator">:</span> <span class="token punctuation">[</span>
        <span class="token punctuation">&#123;</span>
          <span class="token property">"Name"</span><span class="token operator">:</span> <span class="token string">"901a"</span><span class="token punctuation">,</span>
          <span class="token property">"RegionID"</span><span class="token operator">:</span> <span class="token number">901</span><span class="token punctuation">,</span>
          <span class="token property">"DERPPort"</span><span class="token operator">:</span> <span class="token number">33445</span><span class="token punctuation">,</span>
          <span class="token property">"STUNPort"</span><span class="token operator">:</span> <span class="token number">13478</span><span class="token punctuation">,</span>
          <span class="token property">"STUNOnly"</span><span class="token operator">:</span> <span class="token boolean">false</span><span class="token punctuation">,</span>
          <span class="token property">"HostName"</span><span class="token operator">:</span> <span class="token string">"derp.xxx.com"</span>
        <span class="token punctuation">&#125;</span>
      <span class="token punctuation">]</span>
    <span class="token punctuation">&#125;</span>
  <span class="token punctuation">&#125;</span>
<span class="token punctuation">&#125;</span>


#启动服务
systemctl daemon-reload
systemctl enable caddy
systemctl restart caddy<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="10-1-5-配置headscale服务"><a href="#10-1-5-配置headscale服务" class="headerlink" title="10.1.5 配置headscale服务"></a>10.1.5 配置headscale服务</h4><p>注意更改在线json链接，证书路径</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">echo</span> <span class="token string">'net.ipv4.ip_forward = 1'</span> <span class="token operator">|</span> <span class="token function">tee</span> <span class="token parameter variable">-a</span> /etc/sysctl.conf
<span class="token builtin class-name">echo</span> <span class="token string">'net.ipv6.conf.all.forwarding = 1'</span> <span class="token operator">|</span> <span class="token function">tee</span> <span class="token parameter variable">-a</span> /etc/sysctl.conf
<span class="token function">sysctl</span> <span class="token parameter variable">-p</span> /etc/sysctl.conf

<span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /data/headscale/config
<span class="token function">mkdir</span> <span class="token parameter variable">-p</span> /data/headscale/data
<span class="token builtin class-name">cd</span> /data/headscale/data
<span class="token function">touch</span> db.sqlite
<span class="token builtin class-name">cd</span> /data/headscale/config<span class="token punctuation">;</span>

<span class="token comment">#配置你的域名</span>
<span class="token function">vim</span> config.yaml<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<p>vim &#x2F;data&#x2F;headscale&#x2F;config&#x2F;config.yaml</p>
<pre class="line-numbers language-yaml" data-language="yaml"><code class="language-yaml"><span class="token punctuation">---</span>
<span class="token comment"># headscale will look for a configuration file named `config.yaml` (or `config.json`) in the following order:</span>
<span class="token comment">#</span>
<span class="token comment"># - `/etc/headscale`</span>
<span class="token comment"># - `~/.headscale`</span>
<span class="token comment"># - current working directory</span>

<span class="token comment"># The url clients will connect to.</span>
<span class="token comment"># Typically this will be a domain like:</span>
<span class="token comment">#</span>
<span class="token comment"># https://myheadscale.example.com:443</span>
<span class="token comment">#</span>
<span class="token key atrule">server_url</span><span class="token punctuation">:</span> https<span class="token punctuation">:</span>//headscale.xxx.com<span class="token punctuation">:</span><span class="token number">53450</span>

<span class="token comment"># Address to listen to / bind to on the server</span>
<span class="token comment">#</span>
<span class="token comment"># For production:</span>
<span class="token key atrule">listen_addr</span><span class="token punctuation">:</span> 0.0.0.0<span class="token punctuation">:</span><span class="token number">53450</span>
<span class="token comment">#listen_addr: 127.0.0.1:8080</span>
<span class="token comment">#tls:</span>
<span class="token comment">#  cert: /data/caddy/certs/fullchain.pem</span>
<span class="token comment">#  key: /data/caddy/certs/privkey.pem</span>
<span class="token comment">#  redirect_http_to_https: false</span>
<span class="token comment"># Address to listen to /metrics, you may want</span>
<span class="token comment"># to keep this endpoint private to your internal</span>
<span class="token comment"># network</span>
<span class="token comment">#</span>
<span class="token key atrule">metrics_listen_addr</span><span class="token punctuation">:</span> 127.0.0.1<span class="token punctuation">:</span><span class="token number">9090</span>

<span class="token comment"># Address to listen for gRPC.</span>
<span class="token comment"># gRPC is used for controlling a headscale server</span>
<span class="token comment"># remotely with the CLI</span>
<span class="token comment"># Note: Remote access _only_ works if you have</span>
<span class="token comment"># valid certificates.</span>
<span class="token comment">#</span>
<span class="token comment"># For production:</span>
<span class="token comment"># grpc_listen_addr: 0.0.0.0:50443</span>
<span class="token key atrule">grpc_listen_addr</span><span class="token punctuation">:</span> 127.0.0.1<span class="token punctuation">:</span><span class="token number">50443</span>

<span class="token comment"># Allow the gRPC admin interface to run in INSECURE</span>
<span class="token comment"># mode. This is not recommended as the traffic will</span>
<span class="token comment"># be unencrypted. Only enable if you know what you</span>
<span class="token comment"># are doing.</span>
<span class="token key atrule">grpc_allow_insecure</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>

<span class="token comment"># Private key used to encrypt the traffic between headscale</span>
<span class="token comment"># and Tailscale clients.</span>
<span class="token comment"># The private key file will be autogenerated if it's missing.</span>
<span class="token comment">#</span>
<span class="token key atrule">private_key_path</span><span class="token punctuation">:</span> /var/lib/headscale/private.key

<span class="token comment"># The Noise section includes specific configuration for the</span>
<span class="token comment"># TS2021 Noise protocol</span>
<span class="token key atrule">noise</span><span class="token punctuation">:</span>
  <span class="token comment"># The Noise private key is used to encrypt the</span>
  <span class="token comment"># traffic between headscale and Tailscale clients when</span>
  <span class="token comment"># using the new Noise-based protocol. It must be different</span>
  <span class="token comment"># from the legacy private key.</span>
  <span class="token key atrule">private_key_path</span><span class="token punctuation">:</span> /var/lib/headscale/noise_private.key

<span class="token comment"># List of IP prefixes to allocate tailaddresses from.</span>
<span class="token comment"># Each prefix consists of either an IPv4 or IPv6 address,</span>
<span class="token comment"># and the associated prefix length, delimited by a slash.</span>
<span class="token comment"># It must be within IP ranges supported by the Tailscale</span>
<span class="token comment"># client - i.e., subnets of 100.64.0.0/10 and fd7a:115c:a1e0::/48.</span>
<span class="token comment"># See below:</span>
<span class="token comment"># IPv6: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#LL81C52-L81C71</span>
<span class="token comment"># IPv4: https://github.com/tailscale/tailscale/blob/22ebb25e833264f58d7c3f534a8b166894a89536/net/tsaddr/tsaddr.go#L33</span>
<span class="token comment"># Any other range is NOT supported, and it will cause unexpected issues.</span>
<span class="token key atrule">ip_prefixes</span><span class="token punctuation">:</span>
<span class="token comment">#  - fd7a:115c:a1e0::/48</span>
  <span class="token punctuation">-</span> 100.64.0.0/10

<span class="token comment"># DERP is a relay system that Tailscale uses when a direct</span>
<span class="token comment"># connection cannot be established.</span>
<span class="token comment"># https://tailscale.com/blog/how-tailscale-works/#encrypted-tcp-relays-derp</span>
<span class="token comment">#</span>
<span class="token comment"># headscale needs a list of DERP servers that can be presented</span>
<span class="token comment"># to the clients.</span>
<span class="token key atrule">derp</span><span class="token punctuation">:</span>
  <span class="token key atrule">server</span><span class="token punctuation">:</span>
    <span class="token comment"># If enabled, runs the embedded DERP server and merges it into the rest of the DERP config</span>
    <span class="token comment"># The Headscale server_url defined above MUST be using https, DERP requires TLS to be in place</span>
    <span class="token key atrule">enabled</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>
<span class="token comment">#    enabled: true</span>

    <span class="token comment"># Region ID to use for the embedded DERP server.</span>
    <span class="token comment"># The local DERP prevails if the region ID collides with other region ID coming from</span>
    <span class="token comment"># the regular DERP config.</span>
    <span class="token key atrule">region_id</span><span class="token punctuation">:</span> <span class="token number">999</span>

    <span class="token comment"># Region code and name are displayed in the Tailscale UI to identify a DERP region</span>
    <span class="token key atrule">region_code</span><span class="token punctuation">:</span> <span class="token string">"headscale"</span>
    <span class="token key atrule">region_name</span><span class="token punctuation">:</span> <span class="token string">"Headscale Embedded DERP"</span>

    <span class="token comment"># Listens over UDP at the configured address for STUN connections - to help with NAT traversal.</span>
    <span class="token comment"># When the embedded DERP server is enabled stun_listen_addr MUST be defined.</span>
    <span class="token comment">#</span>
    <span class="token comment"># For more details on how this works, check this great article: https://tailscale.com/blog/how-tailscale-works/</span>
    <span class="token key atrule">stun_listen_addr</span><span class="token punctuation">:</span> <span class="token string">"0.0.0.0:3478"</span>

  <span class="token comment"># List of externally available DERP maps encoded in JSON</span>
  <span class="token key atrule">urls</span><span class="token punctuation">:</span>
  <span class="token comment">#  - https://controlplane.tailscale.com/derpmap/default</span>
    <span class="token punctuation">-</span> https<span class="token punctuation">:</span>//xxx.com/derp.json
    <span class="token comment">#- http://127.0.0.1/derp.json</span>
    <span class="token comment">#- https://derp.newitcloud.eu.org:50000/derp.json</span>

  <span class="token comment"># Locally available DERP map files encoded in YAML</span>
  <span class="token comment">#</span>
  <span class="token comment"># This option is mostly interesting for people hosting</span>
  <span class="token comment"># their own DERP servers:</span>
  <span class="token comment"># https://tailscale.com/kb/1118/custom-derp-servers/</span>
  <span class="token comment">#</span>
  <span class="token comment"># paths:</span>
  <span class="token comment">#   - /etc/headscale/derp-example.yaml</span>
  <span class="token key atrule">paths</span><span class="token punctuation">:</span>
      <span class="token comment">#- /etc/headscale/derp-gs.yaml</span>
  <span class="token comment"># If enabled, a worker will be set up to periodically</span>
  <span class="token comment"># refresh the given sources and update the derpmap</span>
  <span class="token comment"># will be set up.</span>
  <span class="token key atrule">auto_update_enabled</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>

  <span class="token comment"># How often should we check for DERP updates?</span>
  <span class="token key atrule">update_frequency</span><span class="token punctuation">:</span> 24h

<span class="token comment"># Disables the automatic check for headscale updates on startup</span>
<span class="token key atrule">disable_check_updates</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>

<span class="token comment"># Time before an inactive ephemeral node is deleted?</span>
<span class="token key atrule">ephemeral_node_inactivity_timeout</span><span class="token punctuation">:</span> 30m

<span class="token comment"># Period to check for node updates within the tailnet. A value too low will severely affect</span>
<span class="token comment"># CPU consumption of Headscale. A value too high (over 60s) will cause problems</span>
<span class="token comment"># for the nodes, as they won't get updates or keep alive messages frequently enough.</span>
<span class="token comment"># In case of doubts, do not touch the default 10s.</span>
<span class="token key atrule">node_update_check_interval</span><span class="token punctuation">:</span> 10s

<span class="token comment"># SQLite config</span>
<span class="token key atrule">db_type</span><span class="token punctuation">:</span> sqlite3

<span class="token comment"># For production:</span>
<span class="token key atrule">db_path</span><span class="token punctuation">:</span> /var/lib/headscale/db.sqlite

<span class="token comment"># # Postgres config</span>
<span class="token comment"># If using a Unix socket to connect to Postgres, set the socket path in the 'host' field and leave 'port' blank.</span>
<span class="token comment"># db_type: postgres</span>
<span class="token comment"># db_host: localhost</span>
<span class="token comment"># db_port: 5432</span>
<span class="token comment"># db_name: headscale</span>
<span class="token comment"># db_user: foo</span>
<span class="token comment"># db_pass: bar</span>

<span class="token comment"># If other 'sslmode' is required instead of 'require(true)' and 'disabled(false)', set the 'sslmode' you need</span>
<span class="token comment"># in the 'db_ssl' field. Refers to https://www.postgresql.org/docs/current/libpq-ssl.html Table 34.1.</span>
<span class="token comment"># db_ssl: false</span>

<span class="token comment">### TLS configuration</span>
<span class="token comment">#</span>
<span class="token comment">## Let's encrypt / ACME</span>
<span class="token comment">#</span>
<span class="token comment"># headscale supports automatically requesting and setting up</span>
<span class="token comment"># TLS for a domain with Let's Encrypt.</span>
<span class="token comment">#</span>
<span class="token comment"># URL to ACME directory</span>
<span class="token key atrule">acme_url</span><span class="token punctuation">:</span> https<span class="token punctuation">:</span>//acme<span class="token punctuation">-</span>v02.api.letsencrypt.org/directory

<span class="token comment"># Email to register with ACME provider</span>
<span class="token key atrule">acme_email</span><span class="token punctuation">:</span> <span class="token string">""</span>

<span class="token comment"># Domain name to request a TLS certificate for:</span>
<span class="token key atrule">tls_letsencrypt_hostname</span><span class="token punctuation">:</span> <span class="token string">""</span>

<span class="token comment"># Path to store certificates and metadata needed by</span>
<span class="token comment"># letsencrypt</span>
<span class="token comment"># For production:</span>
<span class="token key atrule">tls_letsencrypt_cache_dir</span><span class="token punctuation">:</span> /var/lib/headscale/cache

<span class="token comment"># Type of ACME challenge to use, currently supported types:</span>
<span class="token comment"># HTTP-01 or TLS-ALPN-01</span>
<span class="token comment"># See [docs/tls.md](docs/tls.md) for more information</span>
<span class="token key atrule">tls_letsencrypt_challenge_type</span><span class="token punctuation">:</span> HTTP<span class="token punctuation">-</span><span class="token number">01</span>
<span class="token comment"># When HTTP-01 challenge is chosen, letsencrypt must set up a</span>
<span class="token comment"># verification endpoint, and it will be listening on:</span>
<span class="token comment"># :http = port 80</span>
<span class="token key atrule">tls_letsencrypt_listen</span><span class="token punctuation">:</span> <span class="token string">":http"</span>

<span class="token comment">## Use already defined certificates:</span>
<span class="token key atrule">tls_cert_path</span><span class="token punctuation">:</span> <span class="token string">"/certs/fullchain.pem"</span>
<span class="token key atrule">tls_key_path</span><span class="token punctuation">:</span> <span class="token string">"/certs/privkey.pem"</span>

<span class="token key atrule">log</span><span class="token punctuation">:</span>
  <span class="token comment"># Output formatting for logs: text or json</span>
  <span class="token key atrule">format</span><span class="token punctuation">:</span> text
  <span class="token key atrule">level</span><span class="token punctuation">:</span> info

<span class="token comment"># Path to a file containg ACL policies.</span>
<span class="token comment"># ACLs can be defined as YAML or HUJSON.</span>
<span class="token comment"># https://tailscale.com/kb/1018/acls/</span>
<span class="token key atrule">acl_policy_path</span><span class="token punctuation">:</span> <span class="token string">""</span>

<span class="token comment">## DNS</span>
<span class="token comment">#</span>
<span class="token comment"># headscale supports Tailscale's DNS configuration and MagicDNS.</span>
<span class="token comment"># Please have a look to their KB to better understand the concepts:</span>
<span class="token comment">#</span>
<span class="token comment"># - https://tailscale.com/kb/1054/dns/</span>
<span class="token comment"># - https://tailscale.com/kb/1081/magicdns/</span>
<span class="token comment"># - https://tailscale.com/blog/2021-09-private-dns-with-magicdns/</span>
<span class="token comment">#</span>
<span class="token key atrule">dns_config</span><span class="token punctuation">:</span>
  <span class="token comment"># Whether to prefer using Headscale provided DNS or use local.</span>
  <span class="token key atrule">override_local_dns</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>

  <span class="token comment"># List of DNS servers to expose to clients.</span>
  <span class="token key atrule">nameservers</span><span class="token punctuation">:</span>
    <span class="token punctuation">-</span> 223.5.5.5
    <span class="token punctuation">-</span> 114.114.114.114
    <span class="token punctuation">-</span> 8.8.8.8
    <span class="token punctuation">-</span> 1.1.1.1

  <span class="token comment"># NextDNS (see https://tailscale.com/kb/1218/nextdns/).</span>
  <span class="token comment"># "abc123" is example NextDNS ID, replace with yours.</span>
  <span class="token comment">#</span>
  <span class="token comment"># With metadata sharing:</span>
  <span class="token comment"># nameservers:</span>
  <span class="token comment">#   - https://dns.nextdns.io/abc123</span>
  <span class="token comment">#</span>
  <span class="token comment"># Without metadata sharing:</span>
  <span class="token comment"># nameservers:</span>
  <span class="token comment">#   - 2a07:a8c0::ab:c123</span>
  <span class="token comment">#   - 2a07:a8c1::ab:c123</span>

  <span class="token comment"># Split DNS (see https://tailscale.com/kb/1054/dns/),</span>
  <span class="token comment"># list of search domains and the DNS to query for each one.</span>
  <span class="token comment">#</span>
  <span class="token comment"># restricted_nameservers:</span>
  <span class="token comment">#   foo.bar.com:</span>
  <span class="token comment">#     - 1.1.1.1</span>
  <span class="token comment">#   darp.headscale.net:</span>
  <span class="token comment">#     - 1.1.1.1</span>
  <span class="token comment">#     - 8.8.8.8</span>

  <span class="token comment"># Search domains to inject.</span>
  <span class="token key atrule">domains</span><span class="token punctuation">:</span> <span class="token punctuation">[</span><span class="token punctuation">]</span>

  <span class="token comment"># Extra DNS records</span>
  <span class="token comment"># so far only A-records are supported (on the tailscale side)</span>
  <span class="token comment"># See https://github.com/juanfont/headscale/blob/main/docs/dns-records.md#Limitations</span>
  <span class="token comment"># extra_records:</span>
  <span class="token comment">#   - name: "grafana.myvpn.example.com"</span>
  <span class="token comment">#     type: "A"</span>
  <span class="token comment">#     value: "100.64.0.3"</span>
  <span class="token comment">#</span>
  <span class="token comment">#   # you can also put it in one line</span>
  <span class="token comment">#   - &#123; name: "prometheus.myvpn.example.com", type: "A", value: "100.64.0.3" &#125;</span>

  <span class="token comment"># Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).</span>
  <span class="token comment"># Only works if there is at least a nameserver defined.</span>
  <span class="token key atrule">magic_dns</span><span class="token punctuation">:</span> <span class="token boolean important">true</span>

  <span class="token comment"># Defines the base domain to create the hostnames for MagicDNS.</span>
  <span class="token comment"># `base_domain` must be a FQDNs, without the trailing dot.</span>
  <span class="token comment"># The FQDN of the hosts will be</span>
  <span class="token comment"># `hostname.user.base_domain` (e.g., _myhost.myuser.example.com_).</span>
  <span class="token key atrule">base_domain</span><span class="token punctuation">:</span> example.com

<span class="token comment"># Unix socket used for the CLI to connect without authentication</span>
<span class="token comment"># Note: for production you will want to set this to something like:</span>
<span class="token key atrule">unix_socket</span><span class="token punctuation">:</span> /var/run/headscale/headscale.sock
<span class="token key atrule">unix_socket_permission</span><span class="token punctuation">:</span> <span class="token string">"0770"</span>
<span class="token comment">#</span>
<span class="token comment"># headscale supports experimental OpenID connect support,</span>
<span class="token comment"># it is still being tested and might have some bugs, please</span>
<span class="token comment"># help us test it.</span>
<span class="token comment"># OpenID Connect</span>
<span class="token comment"># oidc:</span>
<span class="token comment">#   only_start_if_oidc_is_available: true</span>
<span class="token comment">#   issuer: "https://your-oidc.issuer.com/path"</span>
<span class="token comment">#   client_id: "your-oidc-client-id"</span>
<span class="token comment">#   client_secret: "your-oidc-client-secret"</span>
<span class="token comment">#   # Alternatively, set `client_secret_path` to read the secret from the file.</span>
<span class="token comment">#   # It resolves environment variables, making integration to systemd's</span>
<span class="token comment">#   # `LoadCredential` straightforward:</span>
<span class="token comment">#   client_secret_path: "$&#123;CREDENTIALS_DIRECTORY&#125;/oidc_client_secret"</span>
<span class="token comment">#   # client_secret and client_secret_path are mutually exclusive.</span>
<span class="token comment">#</span>
<span class="token comment">#   # The amount of time from a node is authenticated with OpenID until it</span>
<span class="token comment">#   # expires and needs to reauthenticate.</span>
<span class="token comment">#   # Setting the value to "0" will mean no expiry.</span>
<span class="token comment">#   expiry: 180d</span>
<span class="token comment">#</span>
<span class="token comment">#   # Use the expiry from the token received from OpenID when the user logged</span>
<span class="token comment">#   # in, this will typically lead to frequent need to reauthenticate and should</span>
<span class="token comment">#   # only been enabled if you know what you are doing.</span>
<span class="token comment">#   # Note: enabling this will cause `oidc.expiry` to be ignored.</span>
<span class="token comment">#   use_expiry_from_token: false</span>
<span class="token comment">#</span>
<span class="token comment">#   # Customize the scopes used in the OIDC flow, defaults to "openid", "profile" and "email" and add custom query</span>
<span class="token comment">#   # parameters to the Authorize Endpoint request. Scopes default to "openid", "profile" and "email".</span>
<span class="token comment">#</span>
<span class="token comment">#   scope: ["openid", "profile", "email", "custom"]</span>
<span class="token comment">#   extra_params:</span>
<span class="token comment">#     domain_hint: example.com</span>
<span class="token comment">#</span>
<span class="token comment">#   # List allowed principal domains and/or users. If an authenticated user's domain is not in this list, the</span>
<span class="token comment">#   # authentication request will be rejected.</span>
<span class="token comment">#</span>
<span class="token comment">#   allowed_domains:</span>
<span class="token comment">#     - example.com</span>
<span class="token comment">#   # Note: Groups from keycloak have a leading '/'</span>
<span class="token comment">#   allowed_groups:</span>
<span class="token comment">#     - /headscale</span>
<span class="token comment">#   allowed_users:</span>
<span class="token comment">#     - alice@example.com</span>
<span class="token comment">#</span>
<span class="token comment">#   # If `strip_email_domain` is set to `true`, the domain part of the username email address will be removed.</span>
<span class="token comment">#   # This will transform `first-name.last-name@example.com` to the user `first-name.last-name`</span>
<span class="token comment">#   # If `strip_email_domain` is set to `false` the domain part will NOT be removed resulting to the following</span>
<span class="token comment">#   user: `first-name.last-name.example.com`</span>
<span class="token comment">#</span>
<span class="token comment">#   strip_email_domain: true</span>

<span class="token comment"># Logtail configuration</span>
<span class="token comment"># Logtail is Tailscales logging and auditing infrastructure, it allows the control panel</span>
<span class="token comment"># to instruct tailscale nodes to log their activity to a remote server.</span>
<span class="token key atrule">logtail</span><span class="token punctuation">:</span>
  <span class="token comment"># Enable logtail for this headscales clients.</span>
  <span class="token comment"># As there is currently no support for overriding the log server in headscale, this is</span>
  <span class="token comment"># disabled by default. Enabling this will make your clients send logs to Tailscale Inc.</span>
  <span class="token key atrule">enabled</span><span class="token punctuation">:</span> <span class="token boolean important">false</span>

<span class="token comment"># Enabling this option makes devices prefer a random port for WireGuard traffic over the</span>
<span class="token comment"># default static port 41641. This option is intended as a workaround for some buggy</span>
<span class="token comment"># firewall devices. See https://tailscale.com/kb/1181/firewalls/ for more information.</span>
<span class="token key atrule">randomize_client_port</span><span class="token punctuation">:</span> <span class="token boolean important">true</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>



<h4 id="10-1-1-docker-compose启动"><a href="#10-1-1-docker-compose启动" class="headerlink" title="10.1.1 docker-compose启动"></a>10.1.1 docker-compose启动</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token builtin class-name">cd</span> /data/headscale/
<span class="token function">vim</span> docker-compose.yml
version: <span class="token string">"3.4"</span>

services:
  headscale:
    image: headscale/headscale:0.22.3
    container_name: headscale
    restart: unless-stopped
    entrypoint: headscale serve
    volumes:
      - /data/headscale/config:/etc/headscale/
      - /data/headscale/data:/var/lib/headscale/
      - /data/certs:/certs
    ports:
      - <span class="token string">"53450:53450"</span>
      - <span class="token string">"9090:9090"</span>

<span class="token comment">#启动docker服务</span>
<span class="token function">docker-compose</span> <span class="token parameter variable">-f</span> docker-compose.yml up <span class="token parameter variable">-d</span> --force-recreate<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>



<h4 id="10-1-3-配置caddyfile"><a href="#10-1-3-配置caddyfile" class="headerlink" title="10.1.3 配置caddyfile"></a>10.1.3 配置caddyfile</h4><pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token function">vim</span> Caddyfile
<span class="token comment">#增加这条，域名和证书自己准备好</span>
https://tailscale.xxx域名: <span class="token punctuation">&#123;</span>
        tls /etc/caddy/fullchain.pem /etc/caddy/privkey.pem
        header <span class="token punctuation">&#123;</span>
                Access-Control-Allow-Origin *.xxx.com
                Strict-Transport-Security <span class="token string">"max-age=31536000;"</span>
                X-XSS-Protection <span class="token string">"1; mode=block"</span>
                X-Frame-Options <span class="token string">"SAMEORIGIN"</span>
                X-Robots-Tag <span class="token string">"none"</span>
                <span class="token parameter variable">-Server</span>
        <span class="token punctuation">&#125;</span>

        reverse_proxy http://headscale.这里域名为headscale配置文件里的域名和端口:52014
<span class="token punctuation">&#125;</span><span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<h4 id="10-1-4-注意"><a href="#10-1-4-注意" class="headerlink" title="10.1.4 注意"></a>10.1.4 注意</h4><p>然后把你的代理caddy的https端口开放，用<a href="https://tailscale.xxx域名:端口，就可以访问你自己的headscale服务了">https://tailscale.xxx域名:端口，就可以访问你自己的headscale服务了</a></p>
<p>采用https后手机端设置自己服务器点登录是会一直转圈圈的，命令：docker logs -f headscale 后台看headscale日志，会有弹出手机端发来的请求注册密钥，手动注册就行了。windows就没这个问题，linux也是。</p>
<p>日志如下：</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token shebang important">#!/bin/sh</span>
<span class="token builtin class-name">echo</span> <span class="token string">"======== start clean docker containers logs ========"</span>
<span class="token assign-left variable">logs</span><span class="token operator">=</span><span class="token variable"><span class="token variable">$(</span><span class="token function">find</span> /var/lib/docker/containers/ <span class="token parameter variable">-name</span> *-json.log<span class="token variable">)</span></span>
<span class="token keyword">for</span> <span class="token for-or-select variable">log</span> <span class="token keyword">in</span> <span class="token variable">$logs</span>
<span class="token keyword">do</span>
<span class="token builtin class-name">echo</span> <span class="token string">"clean logs : <span class="token variable">$log</span>"</span>
<span class="token function">cat</span> /dev/null <span class="token operator">></span> <span class="token variable">$log</span>
<span class="token keyword">done</span>
<span class="token builtin class-name">echo</span> <span class="token string">"======== end clean docker containers logs ========"</span>
<span class="token comment"># chmod +x clean_docker_log.sh</span>
<span class="token comment"># ./clean_docker_log.sh</span>

<span class="token assign-left variable">tmp_names</span><span class="token operator">=</span><span class="token variable"><span class="token variable">$(</span><span class="token function">docker</span> <span class="token function">ps</span> <span class="token operator">|</span> <span class="token function">grep</span> headscale<span class="token operator">|</span> <span class="token function">awk</span> <span class="token string">'&#123;print $1&#125;'</span><span class="token variable">)</span></span>
<span class="token assign-left variable">tmp_logs</span><span class="token operator">=</span><span class="token variable"><span class="token variable">$(</span><span class="token function">find</span> /var/lib/docker/containers/ <span class="token parameter variable">-name</span> $tmp_names*-json.log<span class="token variable">)</span></span>
<span class="token function">tail</span> <span class="token parameter variable">-f</span> <span class="token variable">$tmp_logs</span>

<span class="token number">2023</span>-08-24T13:24:08Z INF go/src/headscale/hscontrol/protocol_common.go:574 <span class="token operator">></span> Successfully sent auth url <span class="token assign-left variable">AuthURL</span><span class="token operator">=</span>http://headscale.xxx.com:52014/register/nodekey:70bed72eb610435e9c4cd361224f419d1f0ba7533a338b801bd434002a3acb52 <span class="token assign-left variable">machine</span><span class="token operator">=</span><span class="token string">"Xiaomi 13Pro"</span> <span class="token assign-left variable">noise</span><span class="token operator">=</span>true<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span><span></span></span></code></pre>

<p>命令：</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#default是用户</span>
手动注册命令：
headscale <span class="token parameter variable">--user</span> default nodes register <span class="token parameter variable">--key</span> nodekey:70bed72eb610435e9c4cd361224f419d1f0ba7533a338b801bd434002a3acb52<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span></span></code></pre>

<p>不停的报错误日志：</p>
<pre class="line-numbers language-bash" data-language="bash"><code class="language-bash"><span class="token comment">#从系统日志可以看到tailscaled服务一直会报这个错误，是因为国内被墙了，是访问不到的</span>
Aug <span class="token number">27</span> <span class="token number">14</span>:19:58 localhost tailscaled<span class="token punctuation">[</span><span class="token number">338784</span><span class="token punctuation">]</span>: logtail: dial <span class="token string">"log.tailscale.io:443"</span> failed: dial tcp <span class="token number">54.161</span>.152.147:443: i/o <span class="token function">timeout</span> <span class="token punctuation">(</span>in <span class="token number">30</span>.001s<span class="token punctuation">)</span>, trying bootstrap<span class="token punctuation">..</span>.

<span class="token comment">#解决思路，在有安装tailscale客户端的机器上加上log.tailscale.io，把解析指向本地就好了，但derp服务端要开启443端口的服务caddy，或者nginx，httpd。先把第一台客户端加入headscale里面去就是derp服务端了</span>
<span class="token number">100.64</span>.0.1 log.tailscale.io<span aria-hidden="true" class="line-numbers-rows"><span></span><span></span><span></span><span></span><span></span></span></code></pre>


                
            </div>
            <hr/>

            

    <div class="reprint" id="reprint-statement">
        
            <div class="reprint__author">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-user">
                        文章作者:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="/about" rel="external nofollow noreferrer">Mr.Rootkit</a>
                </span>
            </div>
            <div class="reprint__type">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-link">
                        文章链接:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://zerohacker.gitee.io/2023/08/17/Ubuntu22-04-headscale%E9%83%A8%E7%BD%B2/">https://zerohacker.gitee.io/2023/08/17/Ubuntu22-04-headscale%E9%83%A8%E7%BD%B2/</a>
                </span>
            </div>
            <div class="reprint__notice">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-copyright">
                        版权声明:
                    </i>
                </span>
                <span class="reprint-info">
                    本博客所有文章除特別声明外，均采用
                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
                    许可协议。转载请注明来源
                    <a href="/about" target="_blank">Mr.Rootkit</a>
                    !
                </span>
            </div>
        
    </div>

    <script async defer>
      document.addEventListener("copy", function (e) {
        let toastHTML = '<span>复制成功，请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
        M.toast({html: toastHTML})
      });

      function navToReprintStatement() {
        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
      }
    </script>



            <div class="tag_share" style="display: block;">
                <div class="post-meta__tag-list" style="display: inline-block;">
                    
                        <div class="article-tag">
                            
                                <a href="/tags/VPN/">
                                    <span class="chip bg-color">VPN</span>
                                </a>
                            
                                <a href="/tags/wireguard/">
                                    <span class="chip bg-color">wireguard</span>
                                </a>
                            
                                <a href="/tags/headscale/">
                                    <span class="chip bg-color">headscale</span>
                                </a>
                            
                        </div>
                    
                </div>
                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
                    <link rel="stylesheet" type="text/css" href="/libs/share/css/share.min.css">
<div id="article-share">

    
    <div class="social-share" data-sites="twitter,facebook,google,qq,qzone,wechat,weibo,douban,linkedin" data-wechat-qrcode-helper="<p>微信扫一扫即可分享！</p>"></div>
    <script src="/libs/share/js/social-share.min.js"></script>
    

    

</div>

                </div>
            </div>
            
                <div id="reward">
    <a href="#rewardModal" class="reward-link modal-trigger btn-floating btn-medium waves-effect waves-light red">赏</a>

    <!-- Modal Structure -->
    <div id="rewardModal" class="modal">
        <div class="modal-content">
            <a class="close modal-close"><i class="fas fa-times"></i></a>
            <h4 class="reward-title">你的赏识是我前进的动力</h4>
            <div class="reward-content">
                <div class="reward-tabs">
                    <ul class="tabs row">
                        <li class="tab col s6 alipay-tab waves-effect waves-light"><a href="#alipay">支付宝</a></li>
                        <li class="tab col s6 wechat-tab waves-effect waves-light"><a href="#wechat">微 信</a></li>
                    </ul>
                    <div id="alipay">
                        <img src="/medias/reward/alipay.jpg" class="reward-img" alt="支付宝打赏二维码">
                    </div>
                    <div id="wechat">
                        <img src="/medias/reward/wechat.png" class="reward-img" alt="微信打赏二维码">
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<script>
    $(function () {
        $('.tabs').tabs();
    });
</script>

            
        </div>
    </div>

    

    

    

    

    

    

    

    

    

<article id="prenext-posts" class="prev-next articles">
    <div class="row article-row">
        
        <div class="article col s12 m6" data-aos="fade-up" data-aos="fade-up">
            <div class="article-badge left-badge text-color">
                <i class="far fa-dot-circle"></i>&nbsp;本篇
            </div>
            <div class="card">
                <a href="/2023/08/17/Ubuntu22-04-headscale%E9%83%A8%E7%BD%B2/">
                    <div class="card-image">
                        
                        <img src="/images/Ubuntu22-04-headscale%E9%83%A8%E7%BD%B2/top4.jpg" class="responsive-img" alt="Ubuntu22.04-headscale部署">
                        
                        <span class="card-title">Ubuntu22.04-headscale部署</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            Tailscale 是一种基于 WireGuard 的虚拟组网工具，和 Netmaker 类似，最大的区别在于 Tailscale 是在用户态实现了 WireGuard 协议，而 Netmaker 直接使用了内核态的 WireGuard。所以 Tailscale 相比于内核态 WireGuard 性能会有所损失，但与 OpenVPN 之流相比还是能甩好几十条街的，Tailscale 虽然在性能上做了些许取舍，但在功能和易用性上绝对是完爆其他工具.
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2023-08-17
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/categories/VPN%E6%8A%98%E8%85%BE%E5%90%88%E9%9B%86/" class="post-category">
                                    VPN折腾合集
                                </a>
                            
                            
                        </span>
                    </div>
                </div>

                
                <div class="card-action article-tags">
                    
                    <a href="/tags/VPN/">
                        <span class="chip bg-color">VPN</span>
                    </a>
                    
                    <a href="/tags/wireguard/">
                        <span class="chip bg-color">wireguard</span>
                    </a>
                    
                    <a href="/tags/headscale/">
                        <span class="chip bg-color">headscale</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge right-badge text-color">
                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
            </div>
            <div class="card">
                <a href="/2023/06/26/%E6%96%90%E8%AE%AFN1%E6%8A%98%E8%85%BE%E6%95%99%E7%A8%8B/">
                    <div class="card-image">
                        
                        <img src="/images/%E6%96%90%E8%AE%AFN1%E6%8A%98%E8%85%BE%E6%95%99%E7%A8%8B/top.jpg" class="responsive-img" alt="斐讯N1折腾教程">
                        
                        <span class="card-title">斐讯N1折腾教程</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            主要是已折腾N1为主，测试各种固件以及盒子玩法。
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2023-06-26
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/categories/%E8%BD%AF%E8%B7%AF%E7%94%B1%E6%8A%98%E8%85%BE%E5%90%88%E9%9B%86/" class="post-category">
                                    软路由折腾合集
                                </a>
                            
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/%E8%BD%AF%E8%B7%AF%E7%94%B1/">
                        <span class="chip bg-color">软路由</span>
                    </a>
                    
                    <a href="/tags/openwrt/">
                        <span class="chip bg-color">openwrt</span>
                    </a>
                    
                    <a href="/tags/armbian/">
                        <span class="chip bg-color">armbian</span>
                    </a>
                    
                    <a href="/tags/%E7%94%B5%E8%A7%86%E7%9B%92%E5%AD%90/">
                        <span class="chip bg-color">电视盒子</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
    </div>
</article>

</div>



<!-- 代码块功能依赖 -->
<script type="text/javascript" src="/libs/codeBlock/codeBlockFuction.js"></script>


  <!-- 是否加载使用自带的 prismjs. -->
  <script type="text/javascript" src="/libs/prism/prism.min.js"></script>


<!-- 代码语言 -->

<script type="text/javascript" src="/libs/codeBlock/codeLang.js"></script>


<!-- 代码块复制 -->

<script type="text/javascript" src="/libs/codeBlock/codeCopy.js"></script>


<!-- 代码块收缩 -->

<script type="text/javascript" src="/libs/codeBlock/codeShrink.js"></script>



    </div>
    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
        <div class="toc-widget card" style="background-color: white;">
            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
            <div id="toc-content"></div>
        </div>
    </div>
</div>

<!-- TOC 悬浮按钮. -->

<div id="floating-toc-btn" class="hide-on-med-and-down">
    <a class="btn-floating btn-large bg-color">
        <i class="fas fa-list-ul"></i>
    </a>
</div>


<script src="/libs/tocbot/tocbot.min.js"></script>
<script>
    $(function () {
        tocbot.init({
            tocSelector: '#toc-content',
            contentSelector: '#articleContent',
            headingsOffset: -($(window).height() * 0.4 - 45),
            collapseDepth: Number('0'),
            headingSelector: 'h2, h3, h4'
        });

        // Set scroll toc fixed.
        let tocHeight = parseInt($(window).height() * 0.4 - 64);
        let $tocWidget = $('.toc-widget');
        $(window).scroll(function () {
            let scroll = $(window).scrollTop();
            /* add post toc fixed. */
            if (scroll > tocHeight) {
                $tocWidget.addClass('toc-fixed');
            } else {
                $tocWidget.removeClass('toc-fixed');
            }
        });

        
        /* 修复文章卡片 div 的宽度. */
        let fixPostCardWidth = function (srcId, targetId) {
            let srcDiv = $('#' + srcId);
            if (srcDiv.length === 0) {
                return;
            }

            let w = srcDiv.width();
            if (w >= 450) {
                w = w + 21;
            } else if (w >= 350 && w < 450) {
                w = w + 18;
            } else if (w >= 300 && w < 350) {
                w = w + 16;
            } else {
                w = w + 14;
            }
            $('#' + targetId).width(w);
        };

        // 切换TOC目录展开收缩的相关操作.
        const expandedClass = 'expanded';
        let $tocAside = $('#toc-aside');
        let $mainContent = $('#main-content');
        $('#floating-toc-btn .btn-floating').click(function () {
            if ($tocAside.hasClass(expandedClass)) {
                $tocAside.removeClass(expandedClass).hide();
                $mainContent.removeClass('l9');
            } else {
                $tocAside.addClass(expandedClass).show();
                $mainContent.addClass('l9');
            }
            fixPostCardWidth('artDetail', 'prenext-posts');
        });
        
    });
</script>

    

</main>




    <footer class="page-footer bg-color">
    
        <link rel="stylesheet" href="/libs/aplayer/APlayer.min.css">
<style>
    .aplayer .aplayer-lrc p {
        
        display: none;
        
        font-size: 12px;
        font-weight: 700;
        line-height: 16px !important;
    }

    .aplayer .aplayer-lrc p.aplayer-lrc-current {
        
        display: none;
        
        font-size: 15px;
        color: #42b983;
    }

    
    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body {
        left: -66px !important;
    }

    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body:hover {
        left: 0px !important;
    }

    
</style>
<div class="">
    
    <div class="row">
        <meting-js class="col l8 offset-l2 m10 offset-m1 s12"
                   server="netease"
                   type="playlist"
                   id="503838841"
                   fixed='true'
                   autoplay='false'
                   theme='#42b983'
                   loop='all'
                   order='random'
                   preload='auto'
                   volume='0.7'
                   list-folded='true'
        >
        </meting-js>
    </div>
</div>

<script src="/libs/aplayer/APlayer.min.js"></script>
<script src="/libs/aplayer/Meting.min.js"></script>

    

    <div class="container row center-align"
         style="margin-bottom: 0px !important;">
        <div class="col s12 m8 l8 copy-right">
            Copyright&nbsp;&copy;
            
                <span id="year">2019-2023</span>
            
            <a href="/about" target="_blank">Mr.Rootkit</a>
            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
            |&nbsp;Theme&nbsp;<a href="https://github.com/blinkfox/hexo-theme-matery" target="_blank">Matery</a>
            
            <br>
            
            
            
                
            
            
                <span id="busuanzi_container_site_pv">
                &nbsp;|&nbsp;<i class="far fa-eye"></i>&nbsp;总访问量:&nbsp;
                    <span id="busuanzi_value_site_pv" class="white-color"></span>
            </span>
            
            
                <span id="busuanzi_container_site_uv">
                &nbsp;|&nbsp;<i class="fas fa-users"></i>&nbsp;总访问人数:&nbsp;
                    <span id="busuanzi_value_site_uv" class="white-color"></span>
            </span>
            
            <br>

            <!-- 运行天数提醒. -->
            
            <br>
            
        </div>
        <div class="col s12 m4 l4 social-link social-statis">
    <a href="https://github.com/liangyoufeng" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
        <i class="fab fa-github"></i>
    </a>



    <a href="mailto:254785258@qq.com" class="tooltipped" target="_blank" data-tooltip="邮件联系我" data-position="top" data-delay="50">
        <i class="fas fa-envelope-open"></i>
    </a>







    <a href="tencent://AddContact/?fromId=50&fromSubId=1&subcmd=all&uin=254785258" class="tooltipped" target="_blank" data-tooltip="QQ联系我: 254785258" data-position="top" data-delay="50">
        <i class="fab fa-qq"></i>
    </a>







    <a href="/atom.xml" class="tooltipped" target="_blank" data-tooltip="RSS 订阅" data-position="top" data-delay="50">
        <i class="fas fa-rss"></i>
    </a>

</div>
    </div>
</footer>

<div class="progress-bar"></div>


    <!-- 搜索遮罩框 -->
<div id="searchModal" class="modal">
    <div class="modal-content">
        <div class="search-header">
            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
                   class="search-input">
        </div>
        <div id="searchResult"></div>
    </div>
</div>

<script type="text/javascript">
$(function () {
    var searchFunc = function (path, search_id, content_id) {
        'use strict';
        $.ajax({
            url: path,
            dataType: "xml",
            success: function (xmlResponse) {
                // get the contents from search data
                var datas = $("entry", xmlResponse).map(function () {
                    return {
                        title: $("title", this).text(),
                        content: $("content", this).text(),
                        url: $("url", this).text()
                    };
                }).get();
                var $input = document.getElementById(search_id);
                var $resultContent = document.getElementById(content_id);
                $input.addEventListener('input', function () {
                    var str = '<ul class=\"search-result-list\">';
                    var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
                    $resultContent.innerHTML = "";
                    if (this.value.trim().length <= 0) {
                        return;
                    }
                    // perform local searching
                    datas.forEach(function (data) {
                        var isMatch = true;
                        var data_title = data.title.trim().toLowerCase();
                        var data_content = data.content.trim().replace(/<[^>]+>/g, "").toLowerCase();
                        var data_url = data.url;
                        data_url = data_url.indexOf('/') === 0 ? data.url : '/' + data_url;
                        var index_title = -1;
                        var index_content = -1;
                        var first_occur = -1;
                        // only match artiles with not empty titles and contents
                        if (data_title !== '' && data_content !== '') {
                            keywords.forEach(function (keyword, i) {
                                index_title = data_title.indexOf(keyword);
                                index_content = data_content.indexOf(keyword);
                                if (index_title < 0 && index_content < 0) {
                                    isMatch = false;
                                } else {
                                    if (index_content < 0) {
                                        index_content = 0;
                                    }
                                    if (i === 0) {
                                        first_occur = index_content;
                                    }
                                }
                            });
                        }
                        // show search results
                        if (isMatch) {
                            str += "<li><a href='" + data_url + "' class='search-result-title'>" + data_title + "</a>";
                            var content = data.content.trim().replace(/<[^>]+>/g, "");
                            if (first_occur >= 0) {
                                // cut out 100 characters
                                var start = first_occur - 20;
                                var end = first_occur + 80;
                                if (start < 0) {
                                    start = 0;
                                }
                                if (start === 0) {
                                    end = 100;
                                }
                                if (end > content.length) {
                                    end = content.length;
                                }
                                var match_content = content.substr(start, end);
                                // highlight all keywords
                                keywords.forEach(function (keyword) {
                                    var regS = new RegExp(keyword, "gi");
                                    match_content = match_content.replace(regS, "<em class=\"search-keyword\">" + keyword + "</em>");
                                });

                                str += "<p class=\"search-result\">" + match_content + "...</p>"
                            }
                            str += "</li>";
                        }
                    });
                    str += "</ul>";
                    $resultContent.innerHTML = str;
                });
            }
        });
    };

    searchFunc('/search.xml', 'searchInput', 'searchResult');
});
</script>

    <!-- 白天和黑夜主题 -->
<div class="stars-con">
    <div id="stars"></div>
    <div id="stars2"></div>
    <div id="stars3"></div>  
</div>

<script>
    function switchNightMode() {
        $('<div class="Cuteen_DarkSky"><div class="Cuteen_DarkPlanet"></div></div>').appendTo($('body')),
        setTimeout(function () {
            $('body').hasClass('DarkMode') 
            ? ($('body').removeClass('DarkMode'), localStorage.setItem('isDark', '0'), $('#sum-moon-icon').removeClass("fa-sun").addClass('fa-moon')) 
            : ($('body').addClass('DarkMode'), localStorage.setItem('isDark', '1'), $('#sum-moon-icon').addClass("fa-sun").removeClass('fa-moon')),
            
            setTimeout(function () {
            $('.Cuteen_DarkSky').fadeOut(1e3, function () {
                $(this).remove()
            })
            }, 2e3)
        })
    }
</script>

    <!-- 回到顶部按钮 -->
<div id="backTop" class="top-scroll">
    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
        <i class="fas fa-arrow-up"></i>
    </a>
</div>


    <script src="/libs/materialize/materialize.min.js"></script>
    <script src="/libs/masonry/masonry.pkgd.min.js"></script>
    <script src="/libs/aos/aos.js"></script>
    <script src="/libs/scrollprogress/scrollProgress.min.js"></script>
    <script src="/libs/lightGallery/js/lightgallery-all.min.js"></script>
    <script src="/js/matery.js"></script>

    

    
    
    

    <!-- 雪花特效 -->
    

    <!-- 鼠标星星特效 -->
    

     
        <script src="https://ssl.captcha.qq.com/TCaptcha.js"></script>
        <script src="/libs/others/TencentCaptcha.js"></script>
        <button id="TencentCaptcha" data-appid="xxxxxxxxxx" data-cbfn="callback" type="button" hidden></button>
    

    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    <script src="/libs/others/clicklove.js" async="async"></script>
    
    
    <script async src="/libs/others/busuanzi.pure.mini.js"></script>
    

    

    

    <!--腾讯兔小巢-->
    
    

    

    

    
    <script src="/libs/instantpage/instantpage.js" type="module"></script>
    

</body>

</html>
